Skip to main content

Campaign Creation - Interactive Wizard

CanIPhish Support
Updated

The New Campaign wizard walks you through creating a phishing or training campaign one step at a time. This article takes you through each step. For a description of every option, see Campaigns - Introduction.

Note: Before you start, make sure the employees you want to include are in an employee list, that their email domains are verified, and that you've configured allowlisting.

Contents

Opening the wizard

  1. Go to Phishing & Training > Campaigns.
  2. Click New Campaign.
  3. Choose Simulated Phishing Campaign or Security Awareness Training Campaign.

The wizard's steps are shown across the top. Click Continue to move to the next step, or click a step you've already completed to go back to it. The Campaigns guide link in the wizard's header opens Campaigns - Introduction.

Note: Closing the wizard before you launch discards the campaign. You can have up to 20 active campaigns at a time.

Creating a phishing campaign

Step 1 - Name & audience

  1. Enter a Campaign name. If the name contains characters that aren't allowed, the wizard shows how it will be saved. If a campaign with the same name already exists, the wizard warns you, because launching would replace that campaign.
  2. Under Employees, select one or more employee lists. Use the search box or Select all to find them. The summary underneath shows how many lists and employees you've selected. Lists that include addresses on an unverified domain are flagged, because those employees won't receive emails.
  3. Optionally, turn on New employee sync so that people added to the lists while the campaign is active join it automatically. See New employee sync.
  4. Optionally, expand Advanced settings to add campaign tags, choose the sending mail server, turn on enhanced phishing link expiration, or have the campaign archive itself after delivery.
  5. Click Continue. The wizard checks the selected employees against your monthly quota and lets you know if the campaign could exceed it.

Step 2 - Phishing content

  1. If voice phishing is enabled for your tenant, choose Email Templates or Voice Phishing.
  2. Choose a Language, or Dynamic translation to send each employee the language set on them in your employee lists.
  3. Find emails with the search box and the Difficulty, Payload, Email type, Region and Tags filters. If you have custom templates, use Source to show library or custom emails. Click Save as my default to keep your filters for next time.
  4. Click an email to select it. You can select up to 40, and each employee receives one of them at random. Turn on Selected to show only the emails you've chosen.
  5. Click Preview to open an email in the Email Inbox Simulator. You can click its links and attachments to see what an employee would see, step through the other emails, and select or unselect them from there.
  6. Click Configure to check and adjust an email for this campaign:
    • Who it's from: Choose the sender profile.
    • What lands in the inbox: See the subject, an inbox preview and the employee details the email uses, such as first name or job title.
    • Where it leads: Choose the phishing website, or see how the email delivers its payload instead (an attachment, a reply or a call-back).
    • Send yourself a test: Enter an address on a verified domain and click Send. Tests use sample details (John Doe, IT Manager at Contoso Corp.) and don't count towards your quota.
    Click Save, or Save and select if the email isn't selected yet.
  7. Alternatively, turn on Auto-Phish (Enterprise) to let AI choose the most fitting email for each employee. Describe how it should choose, or start from one of the examples. See Auto-Phish & Auto-Train - Introduction.
  8. For voice phishing, select up to 40 call templates. Click Test call and enter your own verified phone number to receive a test call.
  9. Click Continue.

Note: If an email's sender profile uses your own domain, choose a third-party mail server under Advanced settings in Step 1. Without one, a default sender is used instead.

Step 3 - Follow-up

  1. Choose a Landing page for employees who fall for the simulation:
    • Teachable moment page: A short page that explains the red flags they missed. Click Preview to see it.
    • My own page: Enter the full web address of a page you host, such as your security policy.
    • No landing page: Employees aren't redirected or told it was a simulation.
  2. Choose whether to assign Remedial training. If you choose Yes, assign training, choose who it's assigned to (Anyone who clicks or Only those compromised), then choose the training in the picker that opens below. It works the same way as Step 2 of a training campaign.
  3. Click Continue.

Note: Voice phishing campaigns don't have a landing page or remedial training. To follow up a voice phishing campaign, create a separate training campaign.

Step 4 - Schedule

  1. Choose how the campaign is delivered:
    • Send now: Delivery starts within a few minutes of launching. This is the default.
    • Spread over a window: Click the Delivery days box and pick the first and last day on the calendar. Then set the hours under Each day from and Until, and choose the Time zone. The Schedule summary shows the window, roughly how many emails will go out each hour, and when the first emails will be sent.
    • Schedule later: Save the campaign without a schedule and add one later.
  2. Under Repeat, choose One-off, Weekly, Fortnightly, Monthly or Quarterly. For a recurring campaign, choose a Keep repeating until date.
  3. Click Continue.

For help choosing a window and repeat, see How To Setup A Phishing Or Training Delivery Schedule.

Step 5 - Review & launch

  1. Check the summary of your campaign. Click Edit on any section to go back and change it.
  2. Resolve any warnings at the top of the page, such as a sender on your own domain without a third-party mail server, or a schedule that starts in the past.
  3. If you're reminded about allowlisting, follow the linked setup guides. Once allowlisting is in place, click I've set up allowlisting, don't show this again.
  4. Click Launch campaign.

Creating a training campaign

Step 1 - Name & audience

Follow Step 1 for a phishing campaign. For a training campaign, Advanced settings contains campaign tags only.

Step 2 - Training

  1. Find modules and games with the search box and the Skill level, Audience, Compliance framework, Tags and Source filters.
  2. Click a module to select it. You can select up to 40. Click Preview to open a module in a new tab.
  3. Complete the settings sentence above the modules:
    • Assign: one module intelligently selected (the default) gives each employee one of the selected modules, chosen for them based on their Security IQ, current assignments and completed training. all selected modules gives every employee every selected module.
    • due within: The number of days employees have to complete their training, from 1 to 365 (14 by default).
    • shown in: The training language, or Dynamic translation to use each employee's browser language.
  4. Alternatively, turn on Auto-Train (Enterprise) to let AI choose the most fitting training for each employee.
  5. Click Continue.

Step 3 - Schedule

  1. Choose when the training is assigned:
    • Assign now: Employees are notified within a few minutes of launching. This is the default.
    • Pick a date and time: Choose the Date, Time and Time zone of the first assignment, up to a year ahead.
    • Schedule later: Save the campaign without a schedule and add one later.
  2. Under Repeat, choose One-off, Daily, Weekly, Monthly, Quarterly or Annually. For a recurring campaign, choose a Keep repeating until date. Each repeat assigns the training again to everyone on the selected lists.
  3. Click Continue.

Step 4 - Review & launch

Follow Step 5 for a phishing campaign, then click Launch campaign.

After you launch

You're returned to the Campaigns page, which confirms that the campaign was saved and lists it in the table. While the campaign is being set up, its Next Delivery column shows Updating.... Click the campaign's name at any time to see its statistics.

If you chose Schedule later, nothing is sent or assigned until you add a schedule with Update campaign.

Updating a campaign

  1. On the Campaigns page, open the campaign's actions menu and choose Update campaign.
  2. If the campaign has already started or finished delivery, a warning explains that saving creates a new revision and archives the current one, with its results, for reporting. Click Go back if you'd rather leave it as it is.
  3. The wizard opens at Review & save. Click Edit on any section to change it. The name, the channel (email or voice) and whether the campaign assigns remedial training can't be changed.
  4. Click Save changes.

Note: For a phishing campaign whose schedule has already started, you'll need to choose a new schedule. A training campaign that has already assigned its training is set to Assign now, and saving withdraws its incomplete assignments and assigns the training again. To avoid employees redoing training they've just completed, set a training grace period. See Training - Advanced Settings.

Related articles

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk