Neither should your phishing simulation.
Comparing capability coverage across the landscape
| Capability | APT Phishing Toolkits | Gartner Leaders | TRUSTSTRIKE LABS |
|---|---|---|---|
| Stops at click metrics | ✕ | ✓ | ✕ |
| Detection Evasion | ✓ | ✕ | ✓ |
| Multi-vector (Email, SMS, QR, etc.) | ✓ | ✕ | ✓ |
| Proxy-based infrastructure | ✓ | ✕ | ✓ |
| Redirectors & traffic filtering | ✓ | ✕ | ✓ |
| Real login proxy (AiTM / BitM) | ✓ | ✕ | ✓ |
| Credential theft simulation | ✓ | ✓ | ✓ |
| MFA bypass techniques | ✓ | ✕ | ✓ |
| Session token theft | ✓ | ✕ | ✓ |
| Post-click attack paths | ✓ | ✕ | ✓ |
| Adaptive, real-time behavior | ✓ | ✕ | ✓ |
| Measures actual compromise | ✓ | ✕ | ✓ |
| High annual licensing cost | ✕ | ✓ | ✕ |
Training that actually changes behavior, not just checks a box.