On this page0
Guide
Run a phishing simulation
Send a practice phishing email to your own staff, with a second person’s approval, then read who clicked and who reported it.
Before you start
- This guide assumes you look after security awareness for your company and can reach the people who run its email; if that is not you, pass it to the person who does.
- A role with the permission to run phishing simulations, which shows TrainingPhishing Simulation in your menu. The built-in security analyst role has it, and so does an administrator. The built-in HR manager role does not: the permission to manage training is not enough.
- A second person with the same permission. Whoever prepares a simulation cannot approve it. Only an administrator can approve their own.
- Outgoing email set up under Security & ComplianceSecurity SettingsEmail / SMTP. Without it a simulation can be prepared and approved, but not sent.
- Your mail team told in advance. Every practice email carries the header “X-Zonitix-Simulation”. If they do not allow-list it, the emails may be blocked, or a link scanner may open every link and inflate the click rate.
Check the settings
Step 1: Open the page
Go to TrainingPhishing Simulation and scroll to “Phishing simulation settings”.
Step 2: Set the three values
“Sender name on practice emails” is only the name people see, “IT Service Desk” to begin with. The emails are sent from your own sending address.
“Link address” is where the practice links start. Leave it empty to use your instance’s own address. “Keep per-person results for (months)” takes a whole number from 1 to 36 and starts at 12.
Click “Save settings”. Each change is recorded in the audit log.
Any other link address must be “https://” and a host name with nothing after it, and that domain must already point at your instance. This screen does not set that up.
Prepare the simulation
Step 3: Pick a template
Click “New simulation”. On “Template”, pick one of the six built-in emails: “Password expiry notice”, “Shared document”, “Parcel delivery”, “Invoice to pay”, “HR policy update” or “Unusual sign-in alert”. Each is marked “Easy to spot”, “Medium” or “Hard to spot”. Click “Next”.
Step 4: Check the preview
“Preview” shows “Exactly what each person receives” and “What the page shows after a click”. The text is fixed and cannot be edited. There is no attachment and no picture. Each person gets their own first name and their own practice link.
Step 5: Pick the people
On “People”, search and select who receives it. Only active users of your own company can be picked: an email address cannot be typed in. One simulation can go to at most 2000 people.
Step 6: Choose the follow-up training
On “Training”, pick a course under “Training to point people to”, or leave “None — just their to-do list”. The course is shown to someone who clicked. It is not assigned to them automatically.
Step 7: Name it and choose when
On “When”, enter a “Name of this simulation”, which only your team sees. Set “Send at (optional)”, or leave it empty to send by hand after approval.
Click “Submit for approval”, or “Save draft” to come back to it. Nothing is sent from this window.
Approve and send
Step 8: A second person approves
The simulation shows “Waiting for approval”. Another holder of the permission opens the page and clicks “Approve”. The confirmation names how many people it goes to and who prepared it.
They can click “Send back” instead, which makes it a draft again and removes any approval. Whoever last saves a draft counts as its preparer.
Step 9: Send it
With no send time, anyone with the permission clicks “Send now” on the approved simulation and confirms. With a send time, it goes out by itself once that time has passed; scheduled simulations are checked every five minutes.
The status reads “Sending”, then “Sent”. “Cancel” stops emails that have not gone out yet. Those already sent stay sent.
People are checked again at send time. Someone who is no longer an active user gets nothing and shows as “Not sent”.
What your people see
Step 10: The email, and the page after a click
The practice email arrives from your own sending address under the sender name you set. Its only link opens a page headed “This was a phishing simulation by your security team”, with “What gave it away” and a “Go to my training” button.
That page has no fields. Nothing a person types is collected, because there is nothing to type into.
Step 11: The follow-up and reporting
“Go to my training” leads, after sign-in, to My WorkMy to-do. A notice there says “You opened a practice phishing email.” and names the related training, with “Open the training” if it is already assigned to them and “Report that email now”. What the person does next is in Do a training course you were given.
Anyone can report without clicking: on My WorkMy to-do they click “Report a suspicious email”, paste the link copied from the email and click “Report”. If it was their own practice email it is recorded as reported. If not, nothing is stored and they are told to treat the email as real.
Read the results
Step 12: Open the results
The page shows “Simulations sent”, “Click rate” and “Report rate” across all sent simulations, and each row shows its own “Clicked” and “Reported” rates. Rates are whole percentages of the emails actually sent.
Click “Results” on a row for one line per person, with an outcome of “Reported it”, “Clicked, then reported”, “Clicked the link”, “No action” or “Not sent”. Opening this list is recorded in the audit log every time, with your name.
A click can come from a mail scanner that follows links, not from the person. Check with your mail team before you speak to someone. The results are for coaching.
What it measures, and what it does not
Step 13: Know the scope
- It records three things per person: when the email was sent, the first time their link was opened, and when they reported it.
- It does not track whether an email was opened or read. It has no fake sign-in page and never collects passwords or anything typed.
- Reporting is counted only when the person pastes the link into “Report a suspicious email”. A report made in their mail program, or to your help desk, is not counted.
- It sends only to active users of your own instance, through your instance’s own outgoing email. The six templates name no real company and cannot be rewritten.
- After the months you set, the per-person rows are removed and only the rates are kept. They are also removed when a person’s record is erased.
What you should see
The simulation moves from “Draft” to “Waiting for approval”, “Approved”, “Sending” and “Sent”, and its row shows who prepared and who approved it.
The “People” column reads as sent of total, and the rates fill in as people click or report.
If something goes wrong
- The Approve button is greyed out, with "Someone else must approve it."
- You prepared or last saved this simulation. Ask another person with the permission to approve it. An administrator can approve their own.
- "Outgoing email is not set up yet (Security Settings → Email)."
- Set up outgoing email first. The simulation stays approved and can be sent afterwards.
- "The practice links have no address to point at."
- Your instance has no https address to build the links from. Enter one under Link address in the settings on this page.
- "Only a draft can be changed. Send it back to draft first."
- Click Send back, edit the draft and submit it again. It then needs a fresh approval.
- Almost everyone shows as Clicked within minutes.
- A mail link scanner is probably opening the links. Ask your mail team to allow-list the X-Zonitix-Simulation header before the next simulation.
- Some people show Not sent with an error.
- A failed email is tried again automatically, up to three times in total. Someone who left before sending shows "No longer an active user — nothing was sent."
- "The per-person results of this simulation were removed under your retention setting."
- The simulation is older than the months set under Keep per-person results for (months). The rates are kept; the names cannot be brought back.
Still stuck? See When something goes wrong, or Contact Zonitix support.