The Patented Phishing Test that Introduces Itself

Most phishing tests lie to your employees. This one says hello first!

HootPhish tells people up front: this is practice. No fake “package delivery” trap. No secret scorecard. No walk of shame to your manager or HR. Just a smiling, high-fiving coach, a hyper-realistic email, and rewards for every phish you spot – flock points, avatars, certificates, and bragging rights!

And now the U.S. government has put that positive reinforcement in writing.

On October 6, 2026, the United States Patent and Trademark Office granted CyberHoot U.S. Patent No. 12,756,737 B2, “Positive Reinforcement Phishing Identification Simulations.” It covers HootPhish, our method for teaching people to spot phishing without bamboozling anyone.

We patented positivity. Here’s why that’s a big deal for your business and your people.

The Old Way: A Trap With a Grade at the End

From the employee’s chair

You know the feeling. A “Your package couldn’t be delivered!” email lands in your inbox. You click. Your stomach drops.

Minutes, days, or even weeks later, a notice arrives: you failed a phishing test. Then comes the mandatory training video. If you’re unlucky, you also get a meeting with HR or your manager to go over your mistake.

Your own IT team set a trap, graded you on a test you didn’t know you were taking, and then assigned homework about an email you’d already forgotten. Nobody walks away from that feeling good, including IT.

From the provider’s chair

Now flip the view. If you’re an MSP, you’re the IT department that sent that email. Our patent filing is blunt about what it costs you: attack-based testing is a punishment-based method that can sour employees on IT and reduce their interest in more training.

Your clients’ employees don’t resent the phishing tool. They resent you. Resentful users stop asking IT for help, and that’s when small problems become big ones. What does that do to client retention?

Why the Old Way Falls Short

The patent’s background lays out several other problems with attack-based testing:

• It only measures what people already know. It doesn’t teach them anything new.
• The data is murky. Opened but didn’t click? Clicked but didn’t enter credentials? Reported it, or just got suspicious? It’s hard to say.
• Getting the emails delivered is a headache. Spam filters from Microsoft and Google keep changing, so admins end up maintaining allow-lists, delivery policies, header rules and scripts, and many give up on phishing tests entirely.
• Spoofed brands can cause real legal headaches. If an employee reports a “test” email as the real thing, the company being spoofed can send a cease-and-desist letter.
• Research suggests it can backfire. The patent cites a 15-month study of 14,773 employees by ETH Zurich researchers Daniele Lain, Kari Kostiainen and Srdjan Čapkun. They found that voluntary embedded training during simulated phishing exercises, as commonly used in industry today, “does not make employees more resilient to phishing” and can leave them even more susceptible. Read the study.

How HootPhish Says Hello

The patented approach flips the model. We call it non-deceptive, browser-based phishing training. In plain English:

1. Nobody is bamboozled. First, users get an assignment email leading to a dedicated, browser-based training page. It’s separate from their inbox, so nobody mistakes the exercise for a real attack.
2. We say hello first. We tell every user up front that this is a non-deceptive instructional exercise. The patent claims this disclosure explicitly.
3. Users make the calls themselves. We break a simulated email into clues such as sender, subject, urgency, authority, secrecy, emotional pressure, links and attachments. Then the user judges each one as safe or suspicious.
4. Feedback comes right away. Plus, there’s a “Help Me” link at each step, real-time feedback on each clue, and an instant score and pass/fail result. No waiting two weeks for a verdict.
5. Passing feels good. Better yet, users get a congratulations message instead of a punishment video. Retake the test and we reshuffle the content, so no one can memorize the answers.
6. It teaches, so it sticks. Because users actively analyze a realistic email, lookalike domains included, and get instant feedback on every call, they learn by doing. Compare that to passive training: in a UC San Diego study of more than 19,500 employees, one-third closed the embedded training page immediately, and 75% spent a minute or less on it. Doing beats watching.

Put simply: HootPhish works like an open-book test with your favorite coach instead of a trapdoor.

Why IT Teams and MSPs Should Care

The patent isn’t the point. What it backs up is what you need for employee engagement, behavior change, and even client retention:

• More happy end users. The patent describes this approach as building trust and gratitude between users and their IT providers, instead of resentment.
• No filter gymnastics. Because training happens in a dedicated browser interface, the platform delivers assignment prompts to inboxes without the allow-listing, injection and scripting workarounds that attack-based tools require.
• Cleaner reporting. As a result, you can see who completed assignments, who passed, and which specific indicators people struggle with most. That’s data you can bring to a client conversation.
• Automation. Difficulty adjusts on its own as users improve, and admins can still reset it manually.
• Fun for end users. Users level up avatars, can climb anonymous leaderboards, and earn flock points as rewards.

Does It Work in the Real World?

Patents are nice. Results are better. Here’s what happens when HootPhish training treats users like allies instead of targets.

The numbers. After nine months of CyberHoot awareness training, the Fellsway Group phish tested a financial management firm with $4 billion in assets. Zero percent of employees clicked. The exact same phishing attack had a 30% click rate at another client that hadn’t yet done CyberHoot training. John Mumford, Chief Risk Officer at Fellsway Group, put it this way: “The product really proves its worth!”

The behavior. However, numbers only tell you what happened. Admins tell you what it feels like:

“More employees now send me phishing emails they receive, stating ‘this is a phishing email’ as opposed to just clicking on them.”
— Tim Hurman, System Administrator, Single Digits (8+ year CyberHoot client)

That’s the opposite of the gotcha test. People who get ambushed learn to keep quiet. People who get taught learn to speak up, and then send you the suspicious email before they click.

So What Exactly Did the USPTO Approve?

Patent geeks, this one’s for you. The core claim (claim 1) covers a HootPhish exercise that:

• Presents phishing simulation assignments inside a browser-based instructional interface independent of the user’s email inbox;
• Discloses to the user before starting that the exercise is a non-deceptive instructional exercise;
• Prompts the user to independently evaluate discrete phishing indicators as safe or suspicious using a cumulative assessment; and
• Delivers real-time instructional feedback on each indicator.

The 18 dependent claims cover the finer details: popup-per-indicator flows, realistic typo-squatted domains, immediate scoring, reshuffled retakes, positive reinforcement on passing, adaptive difficulty, ranks and avatars, admin dashboards, and automated delivery without email filter bypass headaches.