Phishing succeeds by exploiting people rather than software, yet many awareness programmes rely on generic training that tells an organisation little about how its own users behave. This paper presents PhishAware, a web-based phishing simulation and awareness training system built with Python and Flask. An administrator creates a campaign through a guided form, chooses one of eight pretext templates or writes a custom email, and sends it to a list of recipients over SMTP. Each campaign carries a unique link; when it is opened, the click is logged with a timestamp and the user sees an awareness page explaining how to recognise suspicious messages. A dashboard and a reports page summarise campaigns, emails sent, recorded clicks and training completions. The system never asks for or stores credentials. A local test with three test mailboxes shows that the sending, tracking, training and reporting pipeline works end to end. Because the test group is very small and tracking is per campaign, the results are a functional validation and not evidence of behavioural change. Limitations and the work needed for a real user study are discussed.

Sapna Pitchamani, Maya Nair, "PhishAware: A Web-Based Phishing Simulation and Awareness Training System" International Journal of Scientific Research and Engineering Development, V9(5): Page(1735-1740) September - October 2026. ISSN: 2581-7175. www.ijsred.com. Published by Scientific and Academic Research Publishing.