Skip to main content

Campaigns - Introduction

CanIPhish Support
Updated

Campaigns are how you deliver simulated phishing and security awareness training to your employees. This article explains the types of campaign you can run, walks through the New Campaign wizard step by step, and covers managing campaigns and reading their results.

Note: Before you launch your first campaign, configure allowlisting so that simulations and training emails reach your employees' inboxes, and verify the domains your employees' email addresses use. Emails to addresses on an unverified domain are not delivered.

Contents

Campaign types

Click New Campaign on the Campaigns page and choose what you would like to run:

  • Simulated Phishing Campaign: Employees receive realistic phishing simulations by email, or by phone if voice phishing is enabled for your tenant. An email simulation can be followed by remedial training, which enrolls anyone who falls for it in training straight away.
  • Security Awareness Training Campaign: Employees are assigned training modules and games, and are emailed a link to their learner dashboard to complete them.
  • AI Program Manager: Rather than creating campaigns one at a time, describe your goals and let AI build, publish and manage a complete program of phishing and training campaigns. This is an Enterprise feature, available to Platform Admins and Super Admins. See AI Program Manager - Introduction.

Phishing simulation types

Every phishing email in the library is labeled with how it tries to compromise the employee:

  • Website link: The email directs the employee to a phishing website, usually a convincing login or data-entry page, and tries to get them to enter sensitive information.
  • Attachment: The email entices the employee to open an attachment. See Attachment Tracking.
  • Information request: The email entices the employee to reply. Using a mix of predetermined scenarios and generative AI, the exchange can lead them to a phishing website, an attachment, or to sharing personal information.
  • Call-back: The email entices the employee to phone a number and gives them a 6-digit caller code. An Interactive Voice Response (IVR) system asks for the code, then hands the call to an AI agent powered by CanIPhish's PhishAI technology, which tries to get the employee to verify their identity. See Callback Voice Phishing Walkthrough.

Emails are also either Standard or Conversational. A conversational email uses generative AI to build trust over a back-and-forth conversation before the payload arrives. See Conversational Phishing - Functionality Walkthrough.

If voice phishing is enabled for your tenant, you can also run voice phishing campaigns, where employees receive a phone call from an AI voice that tries to talk them into sharing information. See Voice Phishing - Feature Overview.

Creating a campaign

Choosing a phishing or training campaign opens the New Campaign wizard:

  • Phishing campaigns have five steps: Name & audience, Phishing content, Follow-up, Schedule, and Review & launch.
  • Training campaigns have four steps: Name & audience, Training, Schedule, and Review & launch.

Click Continue to move to the next step. You can click back to any step you have already completed.

Note: You can have up to 20 active campaigns at a time. To create more, archive campaigns you no longer need. Closing the wizard before you launch discards the details you have entered.

Name & audience

  • Campaign name: Choose a name your team will recognize in reports, such as "All staff - Q4". Names can contain letters, numbers, spaces and hyphens, and other characters are removed or replaced with hyphens. A campaign's name can't be changed after it's created. Use a name that isn't already taken, because saving a campaign with the same name as an existing one replaces the existing campaign.
  • Employees: Choose one or more employee lists. Everyone on the selected lists receives the simulation or is assigned the training. If a list includes addresses on an unverified domain, the wizard warns you that those employees won't receive emails.
  • New employee sync: When this is on, anyone added to the selected lists while the campaign is active automatically joins it. See New employee sync.
  • Advanced settings (optional):
    • Campaign tags: Group campaigns in reports, and limit which campaigns users with the Platform Reporter role can see. Press Enter, comma or space to add a tag. See Restricting User Access with Campaign Tags and Role-Based Access Controls (RBAC).
    • Sending mail server (email phishing only): The mail server that delivers the campaign. Sender profiles on your own domain need a third-party mail server.
    • Enhanced phishing link expiration (email phishing only): Phishing links stop working a second or two after the first click, instead of after 15 minutes, so employees can't revisit the page.
    • Auto-archive campaign (phishing campaigns without remedial training): Archives the campaign a set number of days (1 to 365, 14 by default) after delivery finishes.

Note: When you continue, the wizard checks the selected employees against your monthly quota and warns you if the campaign could exceed it. If Automatic Seat Upgrades is turned on, launching the campaign purchases the additional licenses it needs.

Phishing content

Choose what employees receive. If voice phishing is enabled for your tenant, first choose the channel: Email Templates or Voice Phishing. The channel can't be changed after the campaign is created.

  • Choosing emails: Select up to 40 phishing emails from the library or your own custom templates. Each employee receives one of them at random, so colleagues can't tip each other off. Filter by difficulty, payload, email type, region, tags and source, and use Save as my default to keep your filters for next time.
  • Preview: Opens the email in the Email Inbox Simulator, where you can click its links and attachments to see exactly what an employee would see.
  • Configure: Shows who the email is from, what lands in the inbox and where it leads. You can change the email's sender profile and phishing website for this campaign, and send yourself a test. Test emails use sample details (John Doe, IT Manager at Contoso Corp.), don't count towards your quota, and must be sent to an address on a verified domain.
  • Language: Send every email in one language, or choose Dynamic translation to use the language set on each employee in your employee lists. See Supported Languages.
  • Auto-Phish (Enterprise): Instead of choosing emails yourself, let AI choose the most fitting phishing email for each employee. See Auto-Phish & Auto-Train - Introduction.
  • Voice phishing: Select up to 40 call templates. Use Test call to have a scenario call your own verified phone number (one test call at a time, up to 30 a month).

Note: If an email's sender profile uses your own domain, choose a third-party mail server under Advanced settings on the Name & audience step. Without one, a default sender is used instead.

Note: Some content depends on the subprocessors you allow under Platform Settings > Privacy Settings. Voice phishing and call-back emails need the voice providers, and Auto-Phish and Auto-Train need Azure OpenAI. See Privacy Settings (Subprocessor Management) - Introduction.

Follow-up

Decide what happens when someone falls for an email simulation.

  • Landing page: Where employees go after they fall for the simulation.
    • Teachable moment page: A short page that explains the red flags they missed.
    • My own page: A page you host, such as your security policy.
    • No landing page: No redirect, so employees aren't told it was a simulation.
    The default is set under Platform Settings > Simulated Phish Settings > Phish Education.
  • Remedial training: Choose Yes, assign training to enroll anyone who falls for the simulation in training straight away, or No, phishing only to measure how employees respond without assigning training. With remedial training on, choose who is assigned it:
    • Anyone who clicks: Employees who click a phishing link or open an attachment.
    • Only those compromised: Employees who enter details on the phishing page or open an attachment.
    Under either option, employees who share sensitive information in reply to an email simulation are also assigned training. Then choose the training, as described in Training.

Note: Remedial training is only available for email phishing. To follow up a voice phishing campaign, create a separate training campaign. Whether a campaign assigns remedial training can't be changed after it's created.

Training

Training campaigns, and phishing campaigns with remedial training, use the same training picker:

  • Training modules: Select up to 40 modules and games. Filter by skill level, audience, compliance framework, tags and source, and preview any module before choosing it.
  • Assign:
    • one module intelligently selected (the default): Each employee is assigned one of the selected modules, chosen for them based on their Security IQ, their current assignments and the training they've already completed.
    • all selected modules: Each employee is assigned every selected module.
  • Due within: How many days employees have to complete their training, counted from the day it's assigned (1 to 365 days, 14 by default). See Training due dates and reminders.
  • Language: Show training in one language, or choose Dynamic translation to show it in each employee's browser language.
  • Auto-Train (Enterprise): Let AI choose the most fitting training for each employee. See Auto-Phish & Auto-Train - Introduction.

Schedule

For a phishing campaign, choose how it's delivered:

  • Send now: Delivery starts within a few minutes of launching.
  • Spread over a window: Emails go out gradually between the days and hours you set, in the time zone you choose. Spreading delivery over a few days looks more natural and stops colleagues comparing notes. The Schedule summary shows how delivery will play out.
  • Schedule later: Save the campaign now and add a schedule later with Update campaign on the Campaigns page. Nothing is sent until you do.

Under Repeat, choose One-off, Weekly, Fortnightly, Monthly or Quarterly. A recurring campaign sends a fresh round to the same lists on each cycle until the Keep repeating until date, which can be up to a year ahead. A delivery window can be up to 30 days long for a one-off or quarterly campaign, 21 days for monthly, 10 days for fortnightly and 5 days for weekly.

Tip: Emails are spread evenly across every hour of the window, and each hour's emails go out at a slightly randomized time. With a small audience, some hours send nothing. For a recurring campaign, select several emails so that employees don't receive the same one each round. For worked examples, see How To Setup A Phishing Or Training Delivery Schedule.

For a training campaign, choose when the training is assigned:

  • Assign now: Employees are notified within a few minutes of launching.
  • Pick a date and time: Schedule the first assignment up to a year ahead.
  • Schedule later: Save the campaign now and add a schedule later with Update campaign on the Campaigns page. Nothing is assigned until you do.

Under Repeat, choose One-off, Daily, Weekly, Monthly, Quarterly or Annually. Each repeat assigns the training again to everyone on the selected lists, until the Keep repeating until date, which can be up to four years ahead.

Review & launch

The last step summarizes the campaign. Click Edit on any section to go back and change it. The review also flags anything that needs attention, such as a sender on your own domain without a third-party mail server, or a schedule that starts in the past, and reminds you about allowlisting if you haven't confirmed it. When everything looks right, click Launch campaign.

The Campaigns page

The Campaigns page (Phishing & Training > Campaigns) shows all of your active campaigns. Cards at the top show the days since your last campaign delivery, how much of your monthly quota you've used, and the days until your quota resets.

The Calendar View tab shows when your campaigns deliver or assign. The Campaign View tab lists them in a table with these columns:

  • Campaign Name: Click a name to open the campaign's statistics. Recurring phishing campaigns are marked [Recurring], and recurring training campaigns show how often they repeat, such as [Monthly]. A sync icon shows that new employee sync is on.
  • Campaign Type: Phishing, Training, Phishing & Training (phishing with remedial training), or Vishing (voice phishing).
  • Delivery Status: How many employees have been sent the simulation, or how many trainings have been assigned, out of the total. This tracks delivery, not results. Open the campaign's statistics to see how employees responded.
  • Scheduled Date: The delivery window or assignment date. For a recurring campaign, use the arrows to step through its rounds.
  • Scheduled Time: The daily delivery window or assignment time, with its time zone.
  • Next Delivery: The time until the next delivery or assignment. While changes to a campaign are saving, it shows Updating.... The page reloads itself if the changes finish within about 100 seconds; otherwise, refresh the page.
  • Actions: The campaign's actions menu. See Updating, duplicating and archiving campaigns.

Note: Users with the Platform Reporter role don't have access to the Campaigns page. They view campaign results on the Reporting page, where their access can be limited to campaigns with specific tags.

Updating, duplicating and archiving campaigns

Open a campaign's actions menu from the Actions column to:

  • Update campaign: View or change the campaign in the wizard. The name, the channel (email or voice) and whether it assigns remedial training can't be changed. Updating a campaign that has started or finished delivery archives the current revision, with its results, for reporting, and creates a new revision that delivers or assigns again. Because of this, only update a campaign that's underway if you need to. For a phishing campaign whose schedule has already started, you'll need to choose a new schedule. A training campaign that has already assigned its training is set to Assign now, and saving withdraws its incomplete assignments and assigns the training again.
  • Duplicate campaign: Copies the campaign under a new name. Everything is copied except the schedule, so the copy doesn't deliver anything until you add one with Update campaign.
  • Sync new employees: For a campaign that has finished delivery without new employee sync turned on. See New employee sync.
  • Archive campaign: Stops the campaign, freezes its statistics and removes it from the Campaigns page. Its results stay available on the Reporting page, under Archived Campaigns. For a campaign that assigns training, you can also remove its incomplete training assignments from employees' learner dashboards (this option is selected by default). Archiving can't be undone.
  • Delete campaign: Shown instead of Archive for a phishing campaign that hasn't sent anything yet. Deleting removes the campaign permanently.

Tip: Updating a training campaign assigns its training again. To stop employees having to redo training they've completed recently, set a training grace period under Platform Settings > Training Settings. See Training - Advanced Settings.

Note: While the AI Program Manager is running a program, the campaigns it manages can't be updated, duplicated or archived from this menu. Make changes through the AI Program Manager instead.

New employee sync

New employee sync adds people to a campaign that's already running. When it's on, anyone added to the campaign's employee lists, whether manually, by CSV import or through directory sync, joins the campaign within a few minutes. They receive the phishing simulation or are assigned the training. Each sync adds up to 100 new employees, so if you add more than 100 people to a list at once, create a separate campaign for them.

  • Training campaigns: Sync works whether the campaign is one-off or recurring.
  • Phishing campaigns: Sync works on one-off campaigns only. A recurring phishing campaign sends each round to whoever is on its lists when the round runs, so new employees are included from the next round.

Turn sync on with the New employee sync toggle on the Name & audience step. If a campaign finished delivery without it, choose Sync new employees from the campaign's actions menu. This sends the campaign to up to 100 employees added to its lists since it was delivered, and lets you turn on automatic syncing for the future.

When to use new employee sync

  • Annually recurring training campaign - turn sync on. Without sync, someone who joins just after the campaign runs isn't assigned the training until the next round, which could be a year away. That leaves new employees exposed and can put you out of step with your compliance or regulatory requirements.
  • Monthly recurring training campaign - sync isn't needed. New employees wait at most a month for the next round, which always includes everyone on the lists at the time.
  • Best practice - a dedicated onboarding campaign. Create a one-off training campaign for new starters, such as "New-Employee-Training", with new employee sync turned on and several modules assigned. Monthly campaigns usually maintain existing employees' knowledge one module at a time, but new employees need to get up to speed quickly. A dedicated campaign brings them up to speed, and they then join your regular campaigns from their next round.

Campaign statistics

Click a campaign's name on the Campaigns page, or on the Reporting page, to open its statistics. Reporting also lists archived campaigns. New activity, such as emails viewed or training completed, can take up to 90 seconds to appear.

You can search each statistics table, use Configure Columns to show or hide columns, and use Export to download the table as a PDF or CSV file or copy it to your clipboard.

Phishing campaign statistics

The Campaign Overview shows the campaign's status (Pending, In Progress or Finished) and its totals for emails delivered, emails viewed, replies received, payloads clicked, employees compromised and emails reported. The Campaign Statistics table has a row for each employee:

  • Email Delivered: Whether the simulation was delivered (Success), or why it failed, such as Failure - Domain Not Verified, Failure - Email Quota Exceeded or Failure - Email bounced. Click a bounce to see the receiving mail server's response. Delivery confirms that the receiving mail server accepted the email, not that it reached the employee's inbox.
  • Email Viewed: Whether the employee opened the email. Views are detected when the email's images load. See Troubleshooting: Email Delivery or Email Viewed Tracking Not Working.
  • Reply Received: Whether the employee replied to the email.
  • Payload Interaction: Whether the employee interacted with the payload, for example by clicking a phishing website link.
  • Employee Compromised: Whether the employee entered data on a phishing website, opened an attachment, or provided sensitive information over email.
  • Email Reported: Whether the employee reported the email as phishing.

Columns that are hidden by default include the date of each event, the evidence behind replies, interactions and compromises, and the sender profile, email template and payload each employee received. Evidence shows the email reply, or the IP address and browser behind a click, so you can check results that look wrong. See Reduce False Positives By Excluding Certain IP Addresses.

For a campaign with remedial training, a second Training Campaign tab shows the training assigned to employees who fell for the simulation.

Training campaign statistics

The Training Campaign Overview shows the campaign's status, when training is due, and how many employees have been assigned training, have completed all of it, and have at least one module overdue. The Training Campaign Statistics table has a row for each module assigned to each employee:

  • Training Module: The module or game assigned.
  • Date Assigned: When it was assigned.
  • Attempts: How many attempts the employee has made.
  • Score and Score Date: The employee's best score and when they achieved it.
  • Passing Score: The score needed to complete the module.
  • Time to Complete (hidden by default): The time the employee actively spent on their most recent attempt, across every sitting.
  • Status:
    • Complete: The employee achieved a passing score.
    • Complete (Grace): Marked complete automatically because the employee passed the same module within your training grace period.
    • Not Attempted: The employee hasn't started the module.
    • Failed: The employee has attempted the module but hasn't passed yet.
    • Overdue - N Days: The module wasn't passed by its due date.
    • Error - reason: The training couldn't be assigned, for example because the employee's domain isn't verified or your quota was reached. Once the problem is fixed, use Reassign training.

Voice phishing campaign statistics

Voice phishing campaigns show, for each employee, whether the call was delivered, whether they answered, whether they were compromised and whether they reported the call. An employee counts as compromised when they give at least two pieces of personal or sensitive information to the AI phishing agent. Use Configure Columns to show the call evidence, which includes the call transcript and the information disclosed.

Managing individual employees in a campaign

Each row in a campaign's statistics has an actions menu for adjusting that employee's results. In a phishing campaign you can:

  • Mark false positive: Sets the employee's reply, payload interaction and compromise results to No, for example when a security tool, not the employee, opened a link.
  • Resend email: Sends the simulation again, for example if it was blocked or not received.
  • Mark as reported: Records that the employee reported the email to your IT or security team.
  • Remove employee: Removes the employee and their results from the campaign.

In a training campaign you can:

  • Reassign training: Assigns the training again after a temporary problem, such as an unverified domain or a reached quota, has been fixed.
  • Send reminder: Emails the employee a reminder that covers all of their outstanding training.
  • Auto-complete: Marks the assignment complete with a passing score of 100%, for example when an employee has a legitimate reason not to take it.
  • Remove assignment: Removes the training assignment from the campaign.
  • Download certificate: Downloads the employee's certificate of completion for a completed module.

In a voice phishing campaign, buttons on each row let you mark a false positive (which resets Employee Compromised), resend the call, mark the call as reported, or remove the employee.

Training due dates and reminders

  • Assignment email: When training is assigned, the employee receives an email from noreply@learn.caniphish.com (or your own domain, if you use white-labeling). It lists their modules and due date, and includes their sign-in details and a link to their learner dashboard (https://learn.caniphish.com/Platform/Login).
  • Due date: Employees must reach the passing score within the campaign's Due within period (14 days by default). After that, the module shows as Overdue until they pass it.
  • Reminders: Employees with outstanding training are emailed a reminder every 3 days by default. Reminders continue for 60 days after assignment, or until the due date if that's later (up to 120 days), and stop once the module is passed. Reminders sent after the due date use the overdue reminder email. To change how often reminders are sent, or to turn them off, go to Platform Settings > Notification Settings and set Training Assignment Reminder Frequency (0 to 30 days, where 0 turns reminders off).

Tip: Allowlist training emails as well as phishing simulations. Otherwise they're likely to end up in employees' junk or spam folders.

Frequently asked questions

  • If I select several phishing emails, will each employee receive all of them? No. Each employee receives one email, picked at random from those you selected (or chosen by AI when Auto-Phish is on). Because different employees receive different emails, colleagues are less likely to warn each other about the simulation.
  • If two campaigns assign an employee the same module, will they need to complete it twice? No. If the employee already has that module assigned, the new campaign is linked to the existing assignment, and completing it once counts for both campaigns. If they passed the module recently, within your training grace period, the new assignment is marked Complete (Grace) automatically.
  • How do employees access their training? Through the link in their assignment email, which takes them to their learner dashboard. See Training due dates and reminders.
  • How do I stop a campaign? Archive it from its actions menu on the Campaigns page. This stops further deliveries and keeps its results on the Reporting page.
  • An employee says they didn't click the link. What should I do? Use Configure Columns to show the evidence columns in the campaign's statistics, and check the IP address and browser behind the click. Clicks are often made by email security tools that scan links. If the evidence confirms a false positive, use Mark false positive, and see Reduce False Positives By Excluding Certain IP Addresses to stop it happening again.
  • Why hasn't my campaign's activity appeared yet? New activity can take up to 90 seconds to appear in a campaign's statistics, and overdue training totals on the Reporting page can take up to 24 hours to update.

Phishing simulations are one part of promoting a culture of cyber awareness. Pair them with regular training campaigns and other awareness activities.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk