Phishing test, do it ourselves or buy it in?

A simulated phishing campaign against your own team is fairly standard SMB practice in 2026. DIY is doable, but template quality and reporting usually decide if it is a fun experiment or a real security uplift.

Try this first

1. 1DIY free: Microsoft Defender for Office 365 (Plan 2, or M365 E5/Business Premium with add-on) has Attack Simulator. Templates are ok, reporting is sufficient, free if you already have the license.
2. 2DIY paid: KnowBe4, Hoxhunt, Phished.io give better templates, automated follow-up training and Dutch-language scenarios. You run it.
3. 3MSP-delivered: a security partner runs the campaign, does the analysis, presents to the board. Pricier, but you get benchmark comparison and recommendations that no tool produces.
4. 4Frequency: quarterly is plenty. More than that makes people cynical. Start slow, scale as click rates drop. Avoid name-and-shame culture, anonymous reporting works better.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.