Running Phishing Simulations with BullPhish ID: What We Manage for Clients

Firewalls don’t stop an employee from clicking a convincing fake invoice email. That’s why PalmSol runs ongoing phishing simulations and security awareness training for clients using BullPhish ID — and manages the whole program, not just the software license.

What is BullPhish ID?

BullPhish ID is a phishing simulation and security awareness training platform from Kaseya’s ID Agent line. It lets us send realistic, simulated phishing emails to your staff, then measure who clicked, who reported it, and who needs follow-up training — all backed by a built-in learning management system with short video courses on phishing, password security, data protection, and compliance topics, available in multiple languages with quizzes that confirm the material actually landed.

What a managed phishing simulation program looks like

Licensing the software is the easy part. What actually reduces risk is how the program is run:

• Simulated campaigns built around real-world tactics — fake invoices, credential-harvesting login pages, gift card requests, and other patterns we see actually used against businesses like yours
• Custom landing pages and email templates matched to your industry, not a generic one-size-fits-all test
• Employees who click are automatically enrolled in short, targeted follow-up training — not just added to a spreadsheet
• Recurring campaigns on a regular cadence, so awareness doesn’t fade between one annual test and the next
• Reporting that tracks click-rate and report-rate trends over time, by department and by individual, so you can see whether the training is actually working

Why this matters beyond the training itself

Phishing and other social engineering tactics remain one of the most common ways attackers get their first foothold into a business — and a single click can bypass firewalls, email filtering, and endpoint protection in a way no technical control can fully prevent on its own. Documented, ongoing security awareness training is also increasingly expected by cyber insurance underwriters and shows up directly in HIPAA, PCI DSS, and SOC 2-aligned compliance programs — auditors and insurers want to see that training happened, who completed it, and what the results were, not just that a policy exists on paper.

How PalmSol fits in

Security awareness training is one of the standing pieces of our 24/7 security operations stack, alongside SOC/NOC monitoring, managed detection and response, and patch management — because most breaches start with a click, not a firewall failure. We design and schedule your BullPhish ID campaigns, review the reporting, and fold the results into the quarterly reviews every client gets through our vCIO program, so phishing risk stays a standing agenda item instead of a once-a-year checkbox.

Frequently asked questions

Will simulated phishing emails disrupt our team or feel like a “gotcha”?
No. The goal is measurable improvement, not embarrassment. Employees who click get short, specific follow-up training rather than a public callout, and reporting is used to guide the program, not to punish individuals.

How often do you run campaigns?
On a recurring cadence rather than a single annual test — consistent, lower-key repetition is what actually builds the habit of pausing before someone clicks.