The task
The platform teaches company staff to spot phishing: it sends training phishing emails, runs trainings, and collects statistics for the security team. It was rebuilt on new technology, and the new version was already live at clients when I joined it. A rewrite easily loses how and why the old system worked: campaigns, mail, licences, security.
Two versions of one platform
First came the mature Lucy platform on older technology (Yii 1). Then the new Cyberdise version on Laravel and Vue 3. The purpose stayed the same; the structure and interface are new. There was a break between them: Lucy until the end of 2021, Cyberdise from November 2024.
What I did in Lucy
October 2019 – December 2021, 166 tickets.
- Replies to training emails. Reply tracking and a built-in mail client: the security team sees how an employee reacted to an email, not just that it was delivered.
- Infrastructure checks. Technical checks of mail and antivirus are built into the campaign wizard — for example, whether an email with a spoofed sender gets through. Staff training and checking the company's defences now live in one place.
- Securing the platform itself. I closed critical vulnerabilities: a phishing training simulator must not become a way in for a real attack.
- Support and licences. Support hours tracking, billing, and licences.
- Server build. An automated build of a ready-made server image and a move to Ubuntu: new installations come up predictably.
What I did in Cyberdise
November 2024 – March 2026, 141 tickets. I built both the server and the interface.
- Reports for management — the largest piece. A Word document from a template: campaign and training statistics, charts, test results. The operator exports it without assembling it by hand in Excel.
- Employee portal. Invitations, trainings, learning history. Training phishing emails are not visible to an employee before they are sent.
- Campaign schedules that respect working hours and time zones: emails arrive during the day, not at night.
- Group sync from LDAP and Azure with an event log: you can see who was added, who was skipped, and why.
- Client branding. A logo, background, and styles for each client, including companies that provide security services to their own clients.
- Arabic with right-to-left text: menus, tabs, and lists do not break, and email addresses still read normally.
- View-only role. An auditor sees everything but cannot change anything: the server enforces it, not just the interface.
- PDF diplomas after a training are produced reliably on the live server, not only on a developer's machine.
My role
Large teams worked on the platform in both versions. My share was a stream of hard tickets from server to screen, not all of the code. In the new version I took them on already knowing the platform from the inside, so knowledge of the old version was not lost.
System diagram
An operator — the security specialist on the client's side — works in Lucy or in Cyberdise. The dashed line between them is the move from the old version to the new one, not a connection at runtime. Both versions work with mail and training attacks; employees use the portal in the new version.