Social engineering assessment platform
Targets in. Evidence out.
Run an authorized phishing assessment end to end — scenario, lure, landing page, launch, and evidence — with scope enforced by the engine itself.
Set allowed domains and a time window.
Pick a scenario, adapt lure and pages.
Deliver through a dedicated agent.
Watch events land in real time.
Export evidence for the report.
Follow an assessment from hardened operator access and the scenario library through lure authoring, staged pages, launch controls, and the evidence you hand back.
A single hardened entry point for the assessment team, with local credentials only.
Operator accounts carry TOTP, FIDO2 security keys, and backup codes.
Twelve built-in chains across seven categories — clone one, or build your own.
Compose with merge variables and watch the rendered message update beside you.
Chain stages, branch on submitted fields, and capture only what you authorized.
Import recipients from CSV with positions, departments, and custom fields.
Store SMTP endpoints with encrypted credentials and verify them with a test send.
Compose the module chain that decides who is in scope — and what everyone else sees.
Bind template, groups, pages, and agent, then set the window, interval, and jitter.
Watch the funnel, per-stage submissions, and qualification outcomes as they land.
Every recipient gets an ordered, timestamped record — ready to export as XLSX.
Register target-facing agents and watch their health and heartbeat from the console.
Professional social engineering assessment with a terminal-noir aesthetic.
Model the real chain, not a single form. Stages advance on submission, branch on field rules, and capture exactly the fields you authorize — login, then TOTP, then push approval.
Twelve built-in scenarios across seven categories and three difficulty tiers. Clone one, drop your branding into its slots, and launch — or export it to share across the team.
Schedule a send window, throttle the interval, add jitter, and pause, resume, or cancel mid-flight. Celery workers handle delivery; results stream back over WebSocket.
The control plane stays on your internal network. A disposable agent faces the targets, serves pages, and batches events home — register as many as the engagement needs.
Sixteen pluggable modules decide who is in scope. The authorized recipient sees the exercise; scanners, sandboxes, and everyone else get a benign response and no exposure.
Allowed domains, a start and end time, and a kill switch are enforced at launch. Operator accounts carry TOTP, FIDO2, and backup codes, and every change lands in the audit log.
Start from a proven scenario instead of a blank campaign. Clone it, fill its branding slots, and adapt the chain to the engagement.
Reusable assessment chains
Twelve ready scenarios spanning credential harvest, MFA phishing, document lures, IT helpdesk, and HR themes — from a single-page sign-in to a three-stage push-fatigue chain. Each one carries its email, its staged pages, and a qualification preset, with branding slots left open for the engagement.
Categories
Difficulty
SIPHON modules are regular Django apps, discovered by the same plugin system the agent uses. Qualification modules ship in the box; everything else is an extension point.
Extension points
The chain that decides who is in scope. Each module returns a verdict; anything that is not the authorized recipient — a scanner, a sandbox, a replayed link, a request from outside the agreed geography or window — receives the benign response you configured instead of the exercise.
Get in touch
SIPHON is not public and is supplied for authorized assessments only. Reach out for a walkthrough or to hear when it becomes available.
