← All help articles

Phishing simulation campaigns

How to run a simulated phishing campaign, read click and report rates, and use per-employee resilience scores to target retraining.

Phishing is still the way most attacks start, and the only reliable defence is a team that spots and reports a suspicious email. Phishing simulation lets you send safe, fake phishing emails to your own staff and measure how they respond — so you can train the people who need it, not everyone.

How to run a campaign

Campaigns are launched for you rather than from a self-serve button today:

  1. Ask your customer success manager (CSM) to set up a campaign, or launch one through the API if your team is technical.
  2. You choose the email template and the list of staff to target.
  3. The campaign sends the simulated email, then quietly records who opens it, who clicks the link, and who reports it as suspicious.

Every result flows back to the Phishing simulations dashboard automatically — there's nothing for you to import.

How to read your click rates

The campaign table lists your last five campaigns with four numbers each:

  • Targets — how many people the email was sent to.
  • Opened — how many opened it. Opening alone is low-risk.
  • Clicked — how many clicked the link. This is the number that matters most; lower is better.
  • Reported — how many flagged it as suspicious. This is the number you want to grow over time.

A healthy trend is clicks going down and reports going up across successive campaigns — that's proof your training is landing.

Employee resilience scores

Below the campaigns, each employee gets a resilience score from 0 to 100, where lower means they clicked more and are more at risk. The table is sorted most-at-risk first, and anyone scoring below 50 is flagged "Needs retraining." You also get three quick stats: how many employees are scored, the team's mean resilience, and how many need retraining.

Scores are worked out after a campaign's reporting window closes, so expect them to appear about 7 days after a campaign runs, not instantly.

How to set it up

  1. Confirm your staff email list is up to date so campaigns reach the right people.
  2. Talk to your CSM about cadence — a campaign every few weeks keeps awareness fresh without fatigue.
  3. After each campaign, use the resilience table to book targeted training for anyone in the red before the next one.