{"id":4511,"date":"2023-11-09T12:07:30","date_gmt":"2023-11-09T11:07:30","guid":{"rendered":"https:\/\/sys.buges.sk\/phishingove-simulacie\/"},"modified":"2026-08-29T18:05:59","modified_gmt":"2026-08-29T16:05:59","slug":"phishingove-simulacie","status":"publish","type":"page","link":"https:\/\/sysnetshield.com\/sk\/phishingove-simulacie\/","title":{"rendered":"Phishingov\u00e9 simul\u00e1cie"},"content":{"rendered":"\n
\n
\n
\n

Phishingov\u00e9 simul\u00e1cie<\/strong><\/h1>\n\n\n\n

Phishing je pod\u013ea agent\u00fary ENISA dominantn\u00fdm vektorom po\u010diato\u010dn\u00e9ho prieniku v Eur\u00f3pskej \u00fanii \u2013 stoj\u00ed zhruba za 60 % pr\u00edpadov. Sebalep\u0161ia technick\u00e1 ochrana nepom\u00f4\u017ee, ke\u010f zamestnanec odovzd\u00e1 \u00fato\u010dn\u00edkovi prihlasovacie \u00fadaje s\u00e1m. Uk\u00e1\u017eeme v\u00e1m skuto\u010dn\u00fd stav bezpe\u010dnostn\u00e9ho povedomia vo va\u0161ej organiz\u00e1cii sk\u00f4r, ne\u017e to urobia skuto\u010dn\u00ed \u00fato\u010dn\u00edci. <\/p>\n\n\n\nM\u00e1m z\u00e1ujem o phishingov\u00fa simul\u00e1ciu<\/a>\n<\/div>\n<\/div>\n<\/section>\n\n

\n
\n

\u010co s\u00fa phishingov\u00e9 simul\u00e1cie?<\/h2>\n\n\n\n

Phishingov\u00e1 simul\u00e1cia je kontrolovan\u00fd, etick\u00fd \u00fatok, pri ktorom zamestnanci va\u0161ej firmy dostan\u00fa realisticky vyzeraj\u00face podvodn\u00e9 spr\u00e1vy \u2013 e-maily, SMS alebo telefon\u00e1ty. Cie\u013eom nie je zamestnancov tresta\u0165, ale identifikova\u0165 slab\u00e9 miesta v \u013eudskom \u010dl\u00e1nku bezpe\u010dnostn\u00e9ho re\u0165azca a cielene ich posilni\u0165. <\/p>\n\n\n\n

Simul\u00e1cia prebieha bez predch\u00e1dzaj\u00faceho upozornenia zamestnancov. Len tak mo\u017eno z\u00edska\u0165 v\u00fdsledky, ktor\u00e9 odr\u00e1\u017eaj\u00fa skuto\u010dn\u00e9 spr\u00e1vanie, nie nau\u010den\u00e9 reakcie. Po skon\u010den\u00ed kampane dostanete podrobn\u00fd report s jasn\u00fdm obrazom situ\u00e1cie vo va\u0161ej organiz\u00e1cii. <\/p>\n\n\n\n

Phishingov\u00fd test zamestnancov je dnes \u0161tandardnou s\u00fa\u010das\u0165ou programov kybernetickej bezpe\u010dnosti. Z\u00e1kon o kybernetickej bezpe\u010dnosti (\u010d. 264\/2025 Zb.), nad ktor\u00e9ho plnen\u00edm vykon\u00e1va dozor N\u00daKIB, uklad\u00e1 regulovan\u00fdm subjektom pravideln\u00e9 \u0161kolenia a overovanie bezpe\u010dnostn\u00e9ho povedomia zamestnancov. Phishingov\u00e1 simul\u00e1cia je najpriamej\u0161\u00edm sp\u00f4sobom, ako toto overenie vykona\u0165 a dolo\u017ei\u0165. <\/p>\n<\/div>\n<\/section>\n\n

\n
\n
\n
\n

\u010co simulujeme?<\/h2>\n\n\n\n

Skuto\u010dn\u00ed \u00fato\u010dn\u00edci nekombinuj\u00fa jeden vektor \u2013 kombinuj\u00fa ich nieko\u013eko. Preto ani na\u0161e simul\u00e1cie nie s\u00fa jednorozmern\u00e9. Pokr\u00fdvame v\u0161etky k\u013e\u00fa\u010dov\u00e9 formy phishingov\u00e9ho \u00fatoku: <\/p>\n<\/div>\n\n\n

\n\"Zamestnanec\n<\/div>\n<\/div>\n\n\n
\n
\n<\/rect><\/rect><\/path><\/svg><\/span>\n\n\n\n

E-mailov\u00fd phishing<\/h3>\n\n\n\n

Najroz\u0161\u00edrenej\u0161ia forma \u00fatoku. Zamestnancom doru\u010d\u00edme e-maily napodob\u0148uj\u00face d\u00f4veryhodn\u00e9 in\u0161tit\u00facie \u2013 banky, dod\u00e1vate\u013eov softv\u00e9ru, \u0161t\u00e1tne org\u00e1ny alebo intern\u00e9 oddelenia firmy. Sledujeme, kto e-mail otvoril, klikol na odkaz alebo vyplnil formul\u00e1r. <\/p>\n<\/div>\n\n\n\n

\n<\/circle><\/path><\/svg><\/span>\n\n\n\n

Spear phishing<\/h3>\n\n\n\n

Cielen\u00e9 \u00fatoky na konkr\u00e9tne osoby alebo poz\u00edcie \u2013 mana\u017e\u00e9rov, \u00fa\u010dtovn\u00edkov, IT administr\u00e1torov alebo \u010dlenov \u0161tatut\u00e1rnych org\u00e1nov. Spr\u00e1vy pripravujeme na z\u00e1klade verejne dostupn\u00fdch inform\u00e1ci\u00ed. Spear phishing je v\u00fdrazne \u00fa\u010dinnej\u0161\u00ed ako hromadn\u00e9 kampane. <\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/path><\/svg><\/span>\n\n\n\n

Vishing (hlasov\u00fd phishing)<\/h3>\n\n\n\n

Simulovan\u00e9 podvodn\u00e9 telefon\u00e1ty, pri ktor\u00fdch sa \u00fato\u010dn\u00edk vyd\u00e1va za IT podporu, bankov\u00e9ho poradcu alebo \u00farad. Testujeme, \u010di zamestnanci poskytn\u00fa citliv\u00e9 inform\u00e1cie alebo umo\u017enia vzdialen\u00fd pr\u00edstup pod soci\u00e1lnym tlakom. <\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/path><\/svg><\/span>\n\n\n\n

Smishing (SMS phishing)<\/h3>\n\n\n\n

Podvodn\u00e9 SMS spr\u00e1vy s odkazmi na falo\u0161n\u00e9 str\u00e1nky. Pod\u013ea Verizon DBIR 2026 maj\u00fa hlasov\u00e9 a SMS vektory v simul\u00e1ci\u00e1ch a\u017e o 40 % vy\u0161\u0161iu \u00faspe\u0161nos\u0165 ne\u017e e-mail \u2013 a napriek tomu ich v\u00e4\u010d\u0161ina organiz\u00e1ci\u00ed netestuje. <\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/path><\/svg><\/span>\n\n\n\n

Kombinovan\u00e9 vektory<\/h3>\n\n\n\n

Komplexn\u00e9 scen\u00e1re prep\u00e1jaj\u00face viacero kan\u00e1lov \u2013 napr\u00edklad e-mail nasledovan\u00fd telefon\u00e1tom. Odha\u013euj\u00fa, ako zamestnanci reaguj\u00fa pod tlakom a pri zdanlivo vierohodnej komunik\u00e1cii z viacer\u00fdch zdrojov s\u00fa\u010dasne. <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n

\n
\n

Ako simul\u00e1cia prebieha?<\/h2>\n\n\n\n

Proces je transparentn\u00fd, \u0161trukt\u00farovan\u00fd a minim\u00e1lne za\u0165a\u017euje v\u00e1\u0161 t\u00edm:<\/p>\n\n\n\n

\n
\n
1<\/div>\n\n\n\n

Pr\u00edprava a nastavenie<\/h3>\n\n\n\n

Spolo\u010dne definujeme rozsah testovania, cie\u013eov\u00e9 skupiny zamestnancov a typy scen\u00e1rov. Dohodneme pravidl\u00e1 zapojenia tak, aby simul\u00e1cia zodpovedala va\u0161im regula\u010dn\u00fdm aj intern\u00fdm po\u017eiadavk\u00e1m vr\u00e1tane ZoKB a NIS2. Rozhodne sa tie\u017e, \u010di bude vedenie informovan\u00e9 vopred (white-box), alebo nie (blind). <\/p>\n<\/div>\n\n\n\n

\n
2<\/div>\n\n\n\n

Realiz\u00e1cia kampane<\/h3>\n\n\n\n

Spust\u00edme simulovan\u00fa phishingov\u00fa kampa\u0148 pod\u013ea dohodnut\u00e9ho scen\u00e1ra. Spr\u00e1vy s\u00fa doru\u010den\u00e9 v re\u00e1lnom \u010dase s realistick\u00fdm vzh\u013eadom a technickou vierohodnos\u0165ou. Zamestnancom sa v tejto chv\u00edli ni\u010d nehl\u00e1si \u2013 kampa\u0148 prebieha nen\u00e1padne. <\/p>\n<\/div>\n\n\n\n

\n
3<\/div>\n\n\n\n

Meranie a zber d\u00e1t<\/h3>\n\n\n\n

Priebe\u017ene sledujeme k\u013e\u00fa\u010dov\u00e9 metriky: mieru otvorenia spr\u00e1vy, mieru kliknutia na odkaz, mieru zadania prihlasovac\u00edch \u00fadajov a mieru nahl\u00e1senia pokusu bezpe\u010dnostn\u00e9mu t\u00edmu. D\u00e1ta s\u00fa anonymizovan\u00e9 v s\u00falade s GDPR. <\/p>\n<\/div>\n\n\n\n

\n
4<\/div>\n\n\n\n

Report a odpor\u00fa\u010dania<\/h3>\n\n\n\n

Po ukon\u010den\u00ed kampane spracujeme komplexn\u00fd z\u00e1vere\u010dn\u00fd report. Obsahuje kvantitat\u00edvne v\u00fdsledky, identifik\u00e1ciu rizikov\u00fdch skup\u00edn a konkr\u00e9tne odpor\u00fa\u010dania pre \u010fal\u0161ie kroky \u2013 od cielen\u00fdch \u0161kolen\u00ed po technick\u00e9 opatrenia. <\/p>\n<\/div>\n<\/div>\n\n\n\n

\nM\u00e1m z\u00e1ujem o phishingov\u00fa simul\u00e1ciu<\/a>\n<\/div>\n<\/div>\n<\/section>\n\n
\n
\n

\u010co dostanete?<\/h2>\n\n\n\n

Z\u00e1vere\u010dn\u00fd report je ak\u010dn\u00fd dokument, ktor\u00fd v\u00e1m pom\u00f4\u017ee zlep\u0161i\u0165 bezpe\u010dnostn\u00e9 povedomie v organiz\u00e1cii a z\u00e1rove\u0148 preuk\u00e1za\u0165 plnenie z\u00e1konn\u00fdch po\u017eiadaviek:<\/p>\n\n\n\n

\n\n\n
\n<\/rect><\/rect><\/path><\/svg><\/span>\n\n\n\n

Preh\u013ead kliknut\u00ed<\/strong> \u2013 kto na odkaz klikol, z ak\u00e9ho zariadenia a kedy<\/p>\n<\/div>\n\n\n\n

\n<\/circle><\/path><\/svg><\/span>\n\n\n\n

Zadan\u00e9 \u00fadaje<\/strong> \u2013 ko\u013eko zamestnancov vyplnilo prihlasovacie \u00fadaje na falo\u0161nej str\u00e1nke<\/p>\n<\/div>\n\n\n\n

\n<\/path><\/svg><\/span>\n\n\n\n

Miera nahl\u00e1senia<\/strong> \u2013 ko\u013eko \u013eud\u00ed pokus rozpoznalo a nahl\u00e1silo<\/p>\n<\/div>\n\n\n\n

\n<\/circle><\/path><\/svg><\/span>\n\n\n\n

Rizikov\u00e9 skupiny<\/strong> \u2013 oddelenia a roly s vy\u0161\u0161\u00edm rizikom<\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/svg><\/span>\n\n\n\n

Porovnanie s benchmarkom<\/strong> \u2013 kde stoj\u00edte oproti priemeru odvetvia<\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/svg><\/span>\n\n\n\n

Odpor\u00fa\u010dania<\/strong> \u2013 cielen\u00e9 \u0161kolenia, technick\u00e9 opatrenia, procesn\u00e9 zmeny<\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/path><\/svg><\/span>\n\n\n\n

Executive summary<\/strong> \u2013 jednostr\u00e1nkov\u00fd preh\u013ead pre vedenie<\/p>\n<\/div>\n\n\n\n

\n<\/rect><\/path><\/svg><\/span>\n\n\n\n

Podklady pre N\u00daKIB<\/strong> \u2013 report pou\u017eite\u013en\u00fd ako d\u00f4kaz pre regula\u010dn\u00fd audit<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n

\n
\n
\n
\n\"Kolegovia\n<\/div>\n\n\n
\n

Pre koho s\u00fa phishingov\u00e9 simul\u00e1cie?<\/h2>\n\n\n\n

Phishingov\u00fd test je relevantn\u00fd pre ka\u017ed\u00fa organiz\u00e1ciu, kde zamestnanci pracuj\u00fa s e-mailom a webov\u00fdmi aplik\u00e1ciami. Zvl\u00e1\u0161\u0165 ho odpor\u00fa\u010dame pre: <\/p>\n\n\n\n

<\/path><\/svg><\/span>Organiz\u00e1cie pod NIS2 a ZoKB<\/strong> \u2013 z\u00e1kon vy\u017eaduje akt\u00edvne riadenie \u013eudsk\u00e9ho faktora; simul\u00e1cia je priamym dokladom plnenia tejto povinnosti a podkladom pre spr\u00e1vy N\u00daKIB<\/span><\/p>\n\n\n\n

<\/path><\/svg><\/span>Firmy s programom bezpe\u010dnostn\u00e9ho povedomia<\/strong> \u2013 \u0161kolenie hovor\u00ed, ako sa spr\u00e1va\u0165; simul\u00e1cia overuje, \u010di sa tak zamestnanci skuto\u010dne spr\u00e1vaj\u00fa<\/span><\/p>\n\n\n\n

<\/path><\/svg><\/span>HR a L&D t\u00edmy<\/strong> \u2013 v\u00fdsledky pom\u00e1haj\u00fa identifikova\u0165, ktor\u00e9 skupiny zamestnancov potrebuj\u00fa prioritn\u00fa pozornos\u0165<\/span><\/p>\n\n\n\n

<\/path><\/svg><\/span>Management a C-level<\/strong> \u2013 spear phishing na CEO alebo CFO (whaling) m\u00f4\u017ee ma\u0165 z\u00e1va\u017en\u00e9 finan\u010dn\u00e9 aj reputa\u010dn\u00e9 n\u00e1sledky, preto testujeme aj vedenie<\/span><\/p>\n\n\n\n

<\/path><\/svg><\/span>Regulovan\u00e9 sektory<\/strong> \u2013 finan\u010dn\u00e9 in\u0161tit\u00facie, zdravotn\u00edctvo, verejn\u00e1 spr\u00e1va a priemysel potrebuj\u00fa pravideln\u00e9 overovanie odolnosti zamestnancov<\/span><\/p>\n\n\n\n

Chcete preveri\u0165 aj \u010fal\u0161ie techniky manipul\u00e1cie \u2013 vishing, pretexting alebo vyd\u00e1vanie sa za vedenie? Pozrite sa na testovanie soci\u00e1lneho in\u017einierstva<\/a>. <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n

\n
\n

Pre\u010do SysnetShield?<\/h2>\n\n\n\n

Na trhu je rad firiem, ktor\u00e9 pon\u00fakaj\u00fa bezpe\u010dnostn\u00e9 slu\u017eby. Tu je konkr\u00e9tny rozdiel \u2013 a \u013eudia, ktor\u00ed za n\u00edm stoja: <\/p>\n\n\n\n

\n
\n\"Patrik<\/a>\n\n\n\n

Patrik \u017d\u00e1k<\/a><\/p>\n\n\n\n

Etick\u00fd hacker a Red Teamer so zameran\u00edm na infra\u0161trukt\u00faru<\/p>\n\n\n\nProfil Patrika \u017d\u00e1ka \u2192<\/a>\n<\/div>\n\n\n\n

\n\"Juraj<\/a>\n\n\n\n

Juraj Dani\u0161<\/a><\/p>\n\n\n\n

Etick\u00fd hacker so zameran\u00edm na webov\u00e9 aplik\u00e1cie<\/p>\n\n\n\nProfil Juraja Dani\u0161a \u2192<\/a>\n<\/div>\n<\/div>\n\n\n\n

Certifik\u00e1cia t\u00edmu<\/h3>\n\n\n\n
\"CRTLCRTL<\/span>Certified Red Team Lead<\/span><\/a>\"CRTOCRTO<\/span>Certified Red Team Operator<\/span><\/a>\"CPTSCPTS<\/span>Certified Penetration Testing Specialist<\/span><\/a>\"CNPenCNPen<\/span>Certified Network Pentester<\/span><\/a>\"CCPenX-AWSCCPenX-AWS<\/span>Certified Cloud Pentesting eXpert \u2013 AWS<\/span><\/a>\"C-AI\/MLPenC-AI\/MLPen<\/span>Certified AI\/ML Pentester<\/span><\/a>\"CAPenXCAPenX<\/span>Certified AppSec Pentesting eXpert<\/span><\/a>\"THMTHM WEB1<\/span>Web App Pentester Level 1<\/span><\/a>\"N\u00daKIBN\u00daKIB<\/span>Mana\u017e\u00e9r kybernetickej bezpe\u010dnosti<\/span><\/a><\/div>
\"CRTLCRTL<\/span>Certified Red Team Lead<\/span><\/a>\"CRTOCRTO<\/span>Certified Red Team Operator<\/span><\/a>\"CPTSCPTS<\/span>Certified Penetration Testing Specialist<\/span><\/a>\"CNPenCNPen<\/span>Certified Network Pentester<\/span><\/a>\"CCPenX-AWSCCPenX-AWS<\/span>Certified Cloud Pentesting eXpert \u2013 AWS<\/span><\/a>\"C-AI\/MLPenC-AI\/MLPen<\/span>Certified AI\/ML Pentester<\/span><\/a>\"CAPenXCAPenX<\/span>Certified AppSec Pentesting eXpert<\/span><\/a>\"THMTHM WEB1<\/span>Web App Pentester Level 1<\/span><\/a>\"N\u00daKIBN\u00daKIB<\/span>Mana\u017e\u00e9r kybernetickej bezpe\u010dnosti<\/span><\/a><\/div><\/div><\/div>\n\n\n\n

CRTO<\/strong> aj CPTS<\/strong> s\u00fa plne praktick\u00e9 certifik\u00e1cie \u2013 sk\u00fa\u0161kou je nieko\u013ekod\u0148ov\u00fd \u00fatok v laborat\u00f3rnom prostred\u00ed a spracovanie reportu, nie test s v\u00fdberom odpoved\u00ed.<\/p>\n\n\n\n

\u010co n\u00e1s odli\u0161uje<\/h3>\n\n\n\n
\n
\n<\/circle><\/path><\/svg><\/span>\n\n\n\n

\u0160pecializovan\u00fd t\u00edm, nie subdod\u00e1vatelia<\/h3>\n\n\n\n

Nie sme konzulta\u010dn\u00fd dom, ktor\u00fd pr\u00e1cu prepred\u00e1va. Ka\u017ed\u00fd projekt ved\u00fa priamo \u010dlenovia n\u00e1\u0161ho t\u00edmu s plnou zodpovednos\u0165ou za v\u00fdsledok. <\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/svg><\/span>\n\n\n\n

Manu\u00e1lna pr\u00e1ca, nielen automatizovan\u00e9 n\u00e1stroje<\/h3>\n\n\n\n

Automatick\u00e9 skenery odhalia zn\u00e1me zranite\u013enosti. Logick\u00e9 chyby, business-logic nedostatky a re\u0165azce exploitov odhal\u00ed len sk\u00fasen\u00fd tester, ktor\u00fd mysl\u00ed ako \u00fato\u010dn\u00edk. <\/p>\n<\/div>\n\n\n\n

\n<\/rect><\/rect><\/path><\/svg><\/span>\n\n\n\n

V\u00fdstupy, ktor\u00e9 sa daj\u00fa pou\u017ei\u0165<\/h3>\n\n\n\n

Spr\u00e1va nie je akademick\u00e9 cvi\u010denie. Je p\u00edsan\u00e1 tak, aby v\u00e1\u0161 dev alebo ops t\u00edm mohol hne\u010f za\u010da\u0165 s n\u00e1pravou \u2013 s konkr\u00e9tnymi krokmi a odkazmi na zdroje. <\/p>\n<\/div>\n\n\n\n

\n<\/circle><\/path><\/svg><\/span>\n\n\n\n

Scen\u00e1re na mieru, nie \u0161abl\u00f3ny<\/h3>\n\n\n\n

Ka\u017ed\u00fd projekt staviame pod\u013ea v\u00e1\u0161ho prostredia, va\u0161ich riz\u00edk a va\u0161ich cie\u013eov. Nepou\u017e\u00edvame krabicov\u00e9 metodiky ani generick\u00e9 \u0161abl\u00f3ny. <\/p>\n<\/div>\n\n\n\n

\n<\/path><\/path><\/path><\/svg><\/span>\n\n\n\n

Diskr\u00e9tnos\u0165 a ml\u010danlivos\u0165<\/h3>\n\n\n\n

Pred ka\u017ed\u00fdm projektom podpisujeme NDA. V\u0161etky inform\u00e1cie aj v\u00fdsledky zost\u00e1vaj\u00fa v\u00fdhradne medzi nami a vami. <\/p>\n<\/div>\n\n\n\n

\n<\/rect><\/path><\/svg><\/span>\n\n\n\n

S\u00falad s medzin\u00e1rodn\u00fdmi \u0161tandardmi<\/h3>\n\n\n\n

Metodol\u00f3gia vych\u00e1dza z OWASP, PTES a NIST a je v s\u00falade s NIS2 aj z\u00e1konom o kybernetickej bezpe\u010dnosti \u2013 teda s t\u00fdm, \u010do uzn\u00e1vaj\u00fa regul\u00e1tori aj aud\u00edtori.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n\n

\n
\n

\u010cast\u00e9 ot\u00e1zky<\/h2>\n\n\n\n
\n
\n