How to Create a Phishing Campaign

Phishing attacks pose a major risk to organisations worldwide. Running phishing campaigns helps identify learners who may be vulnerable, and provides opportunities to build awareness, reinforce behaviours, and reduce organisational risk.

✅ Proactive Preparation:

A little setup goes a long way! Before launching your first phishing campaign, we recommend:

Whitelisting

• Ensure phishing and training emails land in learners’ inboxes without being blocked. Follow our Whitelisting Guides for step-by-step setup.

Run a Test Phishing Campaign

• Send a test to 3 - 4 users to check that whitelisting is correctly configured and emails are being delivered.

Launch a Baseline Phishing Test

• Assess your organisation’s current vulnerability to phishing attacks.

Watch our Video Tutorial:

Launch a Phishing Campaign in 6 Simple Steps

Step 1. Create Campaign

• Sign in to your Admin dashboard.
• Go to the Phishing section > Campaigns.
• Click Create Campaign.

Step 2. Select Template

Template Types

• Select Single Template or Random Template
• Use Filters to find the right template, language, Type, Topic and Status.
• Click the three-dot menu (⋮) on any template card.
• Click Select.
• Keep an eye on the selected counter to track how many templates you’ve chosen.

Step 3. Select Recipients

Choose who will receive the phishing campaign:

• Everyone - All active learners
• Specific Departments - Target by department or group
• Specific Learners - Manually choose individuals

Step 4. Set a Schedule

Choose how and when phishing emails are delivered. Emails will begin sending as soon as the campaign starts, unless you schedule a future date or enable random delivery.

Delivery Options

1. Now - Start the campaign immediately. Emails will begin sending as soon as the campaign is launched.
2. Scheduled - Choose a start date, duration, and time for the phishing campaign to begin.
3. Random Delivery - Send emails at random times to learners during your selected window, helping to avoid predictability.

*For Random Delivery:

• Select a launch date.
• Set the active period (e.g 7 days).
• Use the Send email over field to define a delivery window (e.g. 1-3 days).👇🏼

Step 5. Select Training Type

Choose what happens when a learner interacts with a phishing email:

• When the Campaign Ends: Redirects learners to a 404 page, then sends a follow-up training email after campaign completion based on the action they took.
• Just-in-Time Training: Redirects learners to a training page immediately after interaction (e.g. infographic or video).
• No Training: Redirects to a 404 page with no follow-up or training.

Step 6. Complete Setup

1. Click Complete Setup to review your campaign settings.
2. Enter the following:

• Campaign Name
• Description
• Spoofed Sender Name (the name that appears as the sender in learners’ inboxes - e.g. “IT Support” or “Security Team”).

3. To make changes, click Edit next to any section.
4. Click Start Campaign to launch!

*If you’ve scheduled the campaign or selected random delivery, emails will be sent according to your chosen settings.

Campaign Overview

To track progress and performance:

• Go to the Phishing section> Campaigns
• Click on your campaign > View Campaign.
• Click Expand Status ( Top right) to view detailed learner activity and timestamps.

Example:

1. Learner A: Email sent, April 17, 6:30 AM
2. Learner B: Email scheduled, April 18, 5:11 AM

System Emails - What Learners & Admins Receive

If you get stuck, contact our support team via the chatbot - we’re happy to help!