Simulated Phishing, Smishing and USB-Drop Attacks for Employee Security Awareness

APT Defend is a Warsaw-based security awareness platform that trains staff by subjecting them to simulated hacking attacks rather than lectures. It is operated by APT Bait Sp. z o.o. and was built by Polish offensive-security practitioners, among them Andrzej Nowodworski, formerly head of IT security at a major Polish bank, and red team leader Karol Celinski. The product is aimed at small and medium businesses as well as large enterprises, with scenarios tuned to threats seen on the Polish market.

The platform centres on a management console where an administrator selects an attack scenario from a template library or commissions a custom one, imports the target user list, and launches the campaign, a sequence the vendor claims takes under fifteen minutes. Simulations run over email phishing, SMS smishing and dropped USB media, and reach PCs, laptops, phones and tablets. Employees who fall for a lure are routed into e-learning modules and configurable knowledge tests, and results feed follow-up rounds using different scenarios.

Notable is the integration with Modlishka, a reverse proxy that relays traffic between the target and the genuine site, letting simulations demonstrate credential capture even where two-factor authentication is in place. Scenarios can be branded with a customer logo and delivered from dedicated phishing domains, and an in-product function lets staff report suspected attacks. Reporting covers campaign summaries, threat-level and organisational resilience metrics with PDF or Excel export, positioned against GDPR and Polish KNF supervisory expectations.