Phishlevel

Defense-industrial-base contractors need security-awareness evidence and face lures tied to registrations, clearances, contract notices and compliance work. The supplied research confirms mature open-source simulation infrastructure and generic commercial platforms, while finding no reviewed product with the proposed defense-context scenario pack and assessment-evidence output.

Phishlevel lets an authorized security owner define population, dates, channels, scenario, exclusions and escalation contacts. Messages use clearly synthetic or controlled destinations, landing pages never collect real passwords or tokens, and all content is reviewed to avoid impersonating active cases or agencies in a way that creates operational harm. Events are minimized and retained under a declared policy.

The first release should support one organization, one approved scenario and one bilingual remediation path. Message delivery, link open, safe-page interaction, report action, training completion, manager acknowledgment, corrective follow-up and assessor acceptance remain separate. Individual behavior must not become an employment score, and a click cannot prove ignorance, negligence or noncompliance.

The evidence bundle can map campaign artifacts to the controls cited in the supplied record, but applicability and sufficiency belong to the organization's qualified assessor. The product should offer a vertical corpus and cleaner proof trail, not a compliance badge or a more realistic way to deceive employees.

Security or compliance lead at a defense-industrial-base contractor, or an authorized consultant operating campaigns for that contractor