PhisGuard

Generic phishing tests get spotted in the first week. Built an AI phishing-simulation tool. Personalised tests fool the team for real, and the NIS2 paperwork writes itself in the background.

• 01User surface

  The whole experience the user sees

  This frame shows the live product: ai-powered phishing simulation campaigns for companies · realistic scenarios, live tracking, automated awareness training. Every component is ours · scope, design, code, deploy.

• 02Stack behind the screen

  What's powering it: TypeScript, Fastify, PostgreSQL

  6 stack components run behind this frame · TypeScript, Fastify, PostgreSQL drive the visible UI; the rest sit in the data layer. All studio-owned.

• 03What we shipped

  AI-generated campaigns · a different scenario per employee, grounded in company context

  Tailored campaigns · real metric for the company's current maturity

• 04Status

  Private deploy · under NDA.

  Per the client's request the URL stays private · the build, architecture, and lessons can be shared in a scoping call.

• 01 · BRIEF

  Beat the KnowBe4 'everyone gets the same' problem.

  Per-employee scenarios scoped: company name, current news, role-aware vocabulary. Every campaign is unique to the recipient · no two employees see the same lure.

• 02 · ARCHITECTURE

  Stack decisions before any code.

  Decision doc captured the data flow, TypeScript, Fastify, PostgreSQL, Anthropic role split, and the failure modes we'd handle in v1 vs defer. Cross-service boundaries (where AI ends and the web app begins) were drawn here so neither side leaked into the other later.

• 02 · BUILD

  Claude → Gophish → Fastify capture loop.

  Claude drafts personalised emails grounded on company context, Gophish delivers + serves the landing pages, Fastify catches clicks and credentials, and pushes the offender into a 5-minute targeted training within the hour.

• 04 · POLISH

  Performance, accessibility, and observability.

  PSI / a11y / coverage budgets enforced as launch gates. Logging + metrics wired before cut-over · the team can answer 'is it working?' from a dashboard, not a Slack thread. Threat-model checklist signed off before traffic hits the box.

• 03 · SHIP

  Live on a customer org · NIS2 export ready.

  First org rolled out · campaign cadence quarterly, automated micro-learning on every click, CISO export shaped to NIS2 + ISO 27001 evidence requirements.

• 01AI authoring

  Per-employee phishing scenarios

  Claude drafts the lure based on company context + role + current news · 'department-wide same email' is gone.

• 02Capture

  Gophish + Fastify tracking pipeline

  Click, hover, credential entry, and report-as-phish all logged · per-recipient, timestamped, exportable.

• 03Micro-training

  5-min targeted lesson on click

  The training fires while the failure is still fresh · response rate beats emailed PDFs by an order of magnitude.

• 04NIS2

  CISO export shaped to the directive

  One-click report mapping the campaign data to NIS2 evidence + ISO 27001 controls · audit-ready, no spreadsheet bridging.

• 
  01Frame

  Compliance gate · domains + scope agreement

  Before any campaign fires, every target email must sit inside a verified domain, every campaign URL must resolve to an approved host, and an unrevoked PDF scope agreement must be active. Hard guardrails, not 'don't worry'.

• 
  02Frame

  Cloned login · sandboxed preview

  Operator previews the SSO-look-alike landing page in sandbox mode · 'forms cannot submit from here' so the test page itself can never accidentally capture a real credential during preview.

• 
  03Frame

  Campaign telemetry · sent / opened / clicked / submitted / reported

  Live-from-Gophish row refreshes every 15s · sent (8/8), opened (1), clicked (1), submitted (1), reported (0). One PDF export per row carries the same five columns + timestamps for the auditor.

• 
  04Frame

  MailHog · 8 deliveries captured for forensics

  Local MailHog catches every outgoing test email · the operator can replay the exact bytes that hit the user, no 'we think we sent that'. Forensics are reproducible end-to-end.