Currently, companies face a growing threat such as cyber-attacks. One of the forms of cyber-attack that has become relevant in recent years is "phishing". However, many companies erroneously believed that this only a problem of multinational companies, but it is not true, because SME (Small and Medium Enterprises), are equally vulnerable to these attacks. This means that SME needs to establish a low-cost strategy to prevent this threat. In this context, we propose a methodological model based on Gophish, to measure phishing vulnerabilities in SME and develop a pedagogical plan to fight against these.