Welcome to Hook

Launch in five steps

1. 1Safelist Hook’s emails
2. 2Authorize your recipient domains
3. 3Connect your directory (Microsoft, Google, or Okta)
4. 4Turn on the report button (email support)
5. 5Turn on Autopilot

Then follow the 30-day launch plan in the Starter Kit. Hook's Autopilot runs the monthly training and simulations for you.

Your resources

• Starter Kit

  Launch playbook with AI prompts, 6 tip sheets, 5 posters, and 4 ready-to-send launch emails. Undated, so it works any month.

  Download the kit (ZIP, 6 MB) →

• Starter Kit videos

  8 short Hook Studios videos on phishing, passphrases, MFA, texting scams, and reporting, as MP4s for offline use or your own intranet.

  Download the videos (ZIP, 197 MB) →

• Free training videos on YouTube

  The same kind of videos, streaming and always up to date. Easy to share in Teams or Slack.

  Watch the playlist →

• Platform how-to videos

  Short walkthroughs of the Hook platform for admins and MSPs.

  Watch the how-tos →

• Training Library

  Every course and video in the Hook catalog, so you know what your People will see.

  Browse the library →

• Hook Docs

  Step-by-step guides for admins and MSPs: safelisting, directory sync, Autopilot, reports, and troubleshooting.

  Open Hook Docs →

Build your program with AI

Attach the Launch Playbook from the Starter Kit to ChatGPT, Claude, Copilot, or Gemini, then paste one of these prompts. Fill in the [BRACKETS] first. More prompts, including one for MSPs setting up a client, are inside the playbook.

I'm launching a security awareness program with Hook Security. I've attached the Launch Playbook from Hook's Starter Kit.
My organization: [ORG NAME], [NUMBER] people, industry: [INDUSTRY].
The announcement comes from: [LEADER NAME], [TITLE].
People report suspicious messages by: [HOW TO REPORT]. IT contact: [IT CONTACT].
Tone: [friendly / formal / playful].
1. Turn the playbook's 30-day launch plan into a dated calendar starting [START DATE].
2. Rewrite the leadership announcement and the three launch emails for us, with every [BRACKET] filled in. Keep each under 150 words.
3. List anything I still need to set up before day 1.
Use "simulation" and "program." Never call people "users" or suggest punishing anyone who clicks.

Using the attached Hook Starter Kit Launch Playbook, build a 12-month security awareness plan for [ORG NAME].
Each month: one topic from the kit's six tip sheets (phishing, passphrases, MFA and passkeys, software updates, clicked a phishing link, working from anywhere), which tip sheet or poster to share, and a two-sentence message to employees.
Our busiest months are [MONTHS]; keep those light.
Add a quarterly review checklist that leads with our Suspicious Email Reporting Rate, not our click rate.

Three rules for a PsySec program

1. 01

   Make reporting the goal.

   Someone will always click. What stops an attack is a report that lands first, and in large field studies a report often arrives before the first click. Track your Suspicious Email Reporting Rate (SERR) and thank every person who reports.

   Why reporting wins →
2. 02

   Go short and steady.

   Research finds training gains fade within about six months. A few minutes of training and one simulation a month beats an hour-long course once a year.

   The research →
3. 03

   Never shame or score people.

   People who fear getting in trouble don’t report their mistakes. Keep simulation results private, use humor, and treat a click as a learning moment, not a verdict.

   What PsySec is →

Want the evidence behind these? Browse the open research at PsySec.io.