Measure your organization's real risk with a concrete test, instead of estimating it with a survey.
Detect who should be trained first, by name and area, instead of training everyone the same way.
Turn the mistake into learning at the exact moment: whoever falls for it can receive a course assigned automatically, when the topic is fresh.
Keep a comparable timeline, to see if risk goes down simulation after simulation.
Test without consequences before going live, with test mode.
Go to the calendar and create the launch
In the side menu, Awareness → Simulations. The Launch Calendar opens. From there you have two paths: the New Launch button at the top right, or the + below the month you want it to go out in.
Choose Email among the four types. QR and Smishing have their own flow, and USB Drop is not yet available: if you choose it, a notice opens to contact the team.
New email simulation opens, a four-step wizard: Basics, Configuration, Template, and Sending.
Each step saves on its own. Once you finish the first step, the simulation is already saved as a draft. If you close the browser halfway through you lose nothing: you'll find it in the calendar with the DRAFT label and you can pick it up again. A draft sends nothing.
Step 1: Basics
Simulation name: this is internal, to recognize it later. The person who receives the email does not see it. Example: "Q1 Awareness".
Language: the language of the email content. Choose it carefully: afterward you'll only be able to choose templates available in that language.
Audience: who receives the simulation. You have All employees, which takes all active ones, or Custom selection, which opens a search tool where you combine employees, departments, and teams into a single audience. There you'll see three numbers: total users, reachable, and excluded. The Suggested audience option appears but is not yet available.
Test: check this box if it's a trial run. It changes two things: sending stays fixed at "Send now" and cannot be modified, and afterward you'll be able to delete it even if it already has results.
Step 2: Configuration
Recommendation page: required. This is the page the person sees after falling for it, with the security recommendations. It's the moment of greatest attention in the whole exercise.
Training assignment: optional, comes disabled. If you turn it on, whoever falls for it is automatically assigned a course or a learning path, with a deadline to choose: 1 week, 2 weeks, or a number of days.
Step 3: Template
Step 4: Sending
First, when it goes out. There are three modes:
Time period: the emails are spread out between a start date and an end date. You also choose the daily window (all day, business hours from 9 to 18, morning from 6 to 12, afternoon from 12 to 18, or evening from 18 to 23), the time zone, and whether to include weekends. It's the most realistic mode: a real attack doesn't arrive all at once.
Specific date: everything goes out on the same day, at the time you choose.
Send now: it goes out immediately.
Then, from which address it goes out:
Sender: the name the person sees in their inbox.
From: the user and domain the email is sent from.
The domain is preloaded from the template and may not be one of yours. Templates come with a suggested domain that your company may not have assigned. If the one that appears is not among yours, the simulation won't be able to be sent until you choose a valid one. This is intentional: it prevents an email from going out from a domain that isn't yours.
Review and send
Before sending, Review and send opens, with the summary: name, reachable users, assigned training, when it goes out, the recommendation page, and the email preview. If something is wrong, Cancel takes you back to the wizard without losing anything.
When you confirm with Send, the simulation is launched and you return to the Launch Calendar, where you'll already see it. If the send fails, The campaign could not be launched. Review it and try again. appears, and the simulation stays as a draft.
It can't be edited, but from the calendar you can stop it. A stopped campaign can be resumed later by setting a new end date, which has to be in the future.
The language from step 1 filters the available templates. Go back to step 1 with the wizard's back button and change it: you won't lose what you already loaded.
They see the recommendation page you chose in step 2. If you turned on training assignment, they're also assigned the course or path with its deadline, without you having to do anything.
To rehearse without messing up your metrics. It goes out immediately and afterward you can delete it even if it already has results, something that isn't possible with a normal simulation.
The template brought a domain that your company doesn't have assigned. Open the domain selector in step 4 and choose one of yours. If none appears, ask your Whalemate contact to review your account's domains.
