How to Build Real World Phishing Resilience

Preparing for Enterprise Expectations

Goodweek sells through managed service providers. Those MSPs resell Goodweek to their own small- and midsize business clients, who put their own reputations on the line for every product they recommend. If an MSP can't confidently vouch for Goodweek's security, the deal stalls, the partner quietly recommends someone else, or an incident damages the trust the MSP spent years building with its own customers.

With this in mind, Goodweek earned SOC 2 Type I less than a year after founding, an unusually disciplined move for a company at that stage, and is expecting the SOC 2 Type II report by end of October 2026. As the platform matured, sensitive data such as customer records, source code, and credentials spread across AWS, Jira, and Microsoft's file-sharing tools. Leadership knew that a single compromised employee account could become a gateway to it all. That's why Valérie, the COO, wanted to know whether an employee who got hit before an attacker reached a server would recognize the attack.

Turning Phishing Into a Measurable Exercise

Goodweek chose to pursue social engineering because they wanted the human side of their security program to run alongside the technical side from the start.

They didn't want a generic phishing test with an obviously fake link that everyone would pass, and no one would learn from. They wanted pretexts that looked like the emails the employees actually receive. Well-written, contextual, and easy to mistake for the real thing.

Software Secured's team built the campaigns directly with the COO, Valérie. She proposed pretext angles herself and reviewed the campaign design before either one launched. She provided involvement that shaped two tests run within days of each other: one styled as a routine internal survey, the second as a security policy update.

Building a Security Program That Learns

The first campaign established Goodweek's baseline. As is typical for a first-run simulation, a number of employees engaged with the internally themed lure, giving leadership an honest starting point.

The second campaign told a different story. Framed around a security policy. The kind of message an alert employee should question. Fewer people engaged, and not a single employee entered credentials. In less than a week, Goodweek went from a workforce with no tested baseline to one that had already started closing the gap between the two tests.

That shift is the real deliverable. Goodweek's leadership now has a documented, evidence-based read on where its people stand, delivered alongside guidance on recognizing phishing and defending against adversary-in-the-middle attacks.

"My objective is to genuinely assess and progressively strengthen our employees' real-world resilience against modern social engineering attacks. I wanted a program that reflects that reality, not one that creates a false sense of security." Valérie Laffite, Chief Operating Officer, Goodweek

Security is no longer a project Goodweek revisits once a year. It's become an operational discipline that evolves alongside the product, its people, and the threats they face.