Arsen

Arsen replicates email-based social engineering attacks across standard phishing, spear-phishing, CEO fraud, and Business Email Compromise (BEC) scenarios. Microsoft and Google email-delivery integrations allow BEC simulations to be sent from the organization's verified domain. Campaigns can be built from templates or generated by AI, and support attachments, embedded links, and text-based lures. An employee who interacts with a simulated attack receives in-context training tied to that failure. Reporting tracks click rates, credential submission, and campaign outcomes per individual.

Arsen's smishing simulation tests employee resilience against SMS-based attacks, including fake MFA prompts, delivery scams, and account warning lures. Campaigns run in more than 180 countries with local phone numbers and language support, and can be combined with email phishing in hybrid, multi-channel simulations. Behavioral tracking covers link clicks, reported messages, and compromise events, giving security teams visibility into a channel that email-only simulation programs leave untested.

Arsen uses generative AI and voice cloning to place phone calls to selected employees. The AI adjusts the conversation based on how the employee responds, rather than following a fixed script, reflecting how an attacker would adapt during a real interaction. Scenarios include executive impersonation, IT helpdesk impersonation, and executive fraud. Call outcomes, behavioral patterns, and risk levels are tracked per individual and summarized in post-campaign reports.

QR code phishing, sometimes called quishing, can circumvent some email security controls by embedding a malicious URL in a QR code. Arsen's QR code simulation tests an employee's ability to recognize and report suspicious QR codes in email, print, or in-person settings. In addition, a QR code phishing test and QR code simulation builder are available as free tools on Arsen's site for an initial assessment.

Arsen scans for typosquat and look-alike domains that attackers register to impersonate an organization, as well as data leaks that expose employee credentials or internal information usable for social engineering. Alerts notify a security team when compromised data or a suspicious domain is detected, helping identify potential exposures for investigation. This gives a security team visibility into external threats targeting the organization, rather than finding out only after an incident occurs.