OutKept: realistic phishing simulations to train your teams
OutKept is a phishing simulation platform developed in Ghent. Its test emails are written by a community of local ethical phishers, in your staff's language and context. Campaigns run automatically, and every click becomes an opportunity for a reminder or a short training module.
Cyber Praxis is an OutKept partner: we scope the campaigns, read the results and link them to your awareness obligations.
The problem it solves
- Phishing remains the main entry point for attacks, and filters do not stop everything.
- Generic, hastily translated simulations that staff spot immediately and warn each other about.
- One-off awareness sessions, with no measure of progress over time.
- A NIS2 training and basic hygiene requirement that must be demonstrable.
What OutKept does
Local, varied emails
Simulations are written by ethical phishers in more than 20 countries, rewarded when their emails fool people: the messages look like the real attacks in your region.
Automated campaigns
Pick a frequency and start: emails follow one another, varying from one person to the next, which limits colleagues warning each other. Targeted (spear phishing) simulations can be added.
Reporting reflex
A report button in the mailbox, tips pages after a click and email feedback train the right reaction rather than punishing.
OutKept Learning
More than 100 short, multilingual items (videos, case studies, quizzes), automatic invitations for newcomers and certificates at the end.
Dashboard
Live open, click and report rates, by department or role; export, print or API for reporting.
Quick set-up
Two to three hours to get started, user list by CSV file or Azure AD (Entra ID) sync, single sign-on (SSO) and access roles.
What OutKept contributes to NIS2, and what it does not
OutKept directly addresses the NIS2 awareness and training requirement, and provides measurable indicators to demonstrate it. The rest of compliance is handled elsewhere.
| NIS2 measure | Reference | OutKept contribution |
|---|---|---|
| Basic cyber hygiene and cybersecurity training | Art. 21(2)(g) | Direct |
| Assessing the effectiveness of measures | Art. 21(2)(f) | Partial: trend in click and report rates |
| Training of management body members | Art. 20(2) | Partial: online path, to be completed with a dedicated session |
| Incident handling | Art. 21(2)(b) | Partial: users reporting suspicious emails |
| Policies, vulnerability handling, access, suppliers | Art. 21(2)(a), (d), (e), (i) | None |
Cyber Praxis reading of Articles 20 and 21 of the NIS2 Directive, transposed in Belgium by the Law of 26 April 2024. A campaign's figures are acceptable evidence of the awareness measure in a CyFun audit.
What Cyber Praxis does
OutKept provides the simulations and the training. We turn them into a monitored programme whose results make sense to management and to the auditor.
Scoping
Choosing target groups, campaign frequency and difficulty, and informing staff and, where needed, their representatives in advance.
Set-up
Importing users, configuring the report button, mail system allow-lists and training paths.
Reading the results
Analysing campaigns, identifying the most exposed departments, periodic report to management.
Next steps
Awareness session for management or high-risk teams, and mapping the results to NIS2 and CyFun requirements.
Frequently asked questions about OutKept
Are phishing simulations GDPR-compliant?
Yes, if they are properly framed: staff informed in advance, an awareness purpose rather than a disciplinary one, results used in aggregate. The platform is designed that way, and we help you document the processing.
Are staff who click penalised?
No. A click leads to a tips page and, if you wish, to a short training module. The aim is to build a reflex, especially reporting a suspicious message.
Are the emails available in French and Dutch?
Yes. Simulations are written by local ethical phishers, and the training content is multilingual.
How long does it take to get started?
Set-up usually takes two to three hours. The first campaigns can go out straight afterwards, once staff have been informed.