Phishing Simulation

This page describes how a simulation is set up and sent, what is recorded about each person and what the person sees after clicking. Phishing simulation comes with Training, on Team and Advanced. Phishing simulation is part of the preview and not yet validated end-to-end against a real mailbox. This page is part of the reference Training, Phishing & Policy Signing.

What It Does

What is sent. One of six built-in emails, with no attachment. People are picked from your active users; an address cannot be typed in.
A second person approves. Nothing can be sent until a second person approves. The person who last saved the draft is refused; an administrator is the one exception.
Sending. An approved simulation is sent at once or at a time you set. Emails leave through your instance’s own outgoing email, from your own sending address. One simulation can go to at most 2000 people.
What is recorded per person. When the email was sent, the first time the link was opened, and when the person reported it. Email opens are not tracked, and nothing a person types is collected: the page behind the link has no fields.
After a click. The link opens a page, with no sign-in, saying that this was a phishing simulation by your security team. It shows only the giveaways.
Reporting. A person reports a practice email from their to-do list by pasting its link. Reports made in a mail program are not counted.
Results. A click rate and a report rate, as whole percentages of the emails actually sent, and a result per person. A click can come from a mail scanner that follows links, not from the person.
How long results are kept. Per-person results are kept for 1 to 36 months, starting at 12. After that the per-person rows are removed and the rates are kept.

Phishing Simulation (Included From Team)

TRAININGPhishing Simulation sends a practice phishing email to your own staff and records who clicked the link and who reported it. A simulation is one of six built-in emails, copied when the simulation is created, so what is approved is exactly what is sent. The text cannot be edited, there is no attachment, and people are picked from your active users: an address cannot be typed in. It comes with Training, on Team and Advanced.

Phishing simulation is part of the preview and not yet validated end-to-end against a real mailbox.

States Of A Simulation

“Draft”, “Waiting for approval”, “Approved”, “Sending”, “Sent”, or “Cancelled” at any point before it is sent. Only a draft can be changed or deleted. “Send back” returns a waiting or approved simulation to draft and removes its approval.

Approval And Separation Of Duties

Nothing can be sent until a second person clicks “Approve”. The person who last saved the draft is refused, on the server as well as on the button. An administrator is the one exception. Only an approved simulation can be sent.

Sending

“Send now” sends an approved simulation; with “Send at (optional)” set it goes out once that time has passed, checked every five minutes. Emails leave through your instance’s own outgoing email, from your own sending address, with only the sender name changed and the header “X-Zonitix-Simulation” on each. A failed email is tried up to three times. One simulation can go to at most 2000 people.

What Is Recorded Per Person

When the email was sent, the first time the link was opened, and when the person reported it. Later opens change nothing. Email opens are not tracked, and nothing a person types is collected: the page behind the link has no fields. Only a hash of each person’s link is stored.

The Public Landing Link

The link in the email opens “This was a phishing simulation by your security team” with no sign-in. The page shows only the giveaways, never a name or a simulation title, and an unknown link gets the same kind of page as a real one.

Reporting

On MY WORKMy to-do, “Report a suspicious email” takes a pasted link. It matches only the person’s own practice email and records it as reported. A link that is not a practice email is not stored. Reports made in a mail program are not counted.

Results And Rates

“Click rate” and “Report rate” are whole percentages of the emails actually sent. “Results” lists each person as “Reported it”, “Clicked, then reported”, “Clicked the link”, “No action” or “Not sent”. A click can come from a mail scanner that follows links, not from the person.

Follow-Up Training

A simulation can point to one active training course. After a click, “Go to my training” leads to the person’s to-do list, where that course is named. It is not assigned automatically; “Open the training” appears only if it is already assigned to them.

Settings And Retention

“Phishing simulation settings” holds “Sender name on practice emails” (starts as IT Service Desk), “Link address” (empty uses your instance’s own address) and “Keep per-person results for (months)”, 1 to 36, starting at 12. A daily check removes the per-person rows of older simulations and keeps the rates. The rows are also removed when a person’s record is erased.

Permission And Audit Log

Everything except reporting needs the phishing-simulation permission, which the built-in security analyst role and administrators hold. The training permission does not grant it. Creating, changing, submitting, approving, sending back, cancelling, sending, a settings change, a person’s first report and every opening of the per-person results are written to the audit log.

If something here is not working as you expect, start with When something goes wrong.

The plain explanation is above. This part is for IT and developers: the exact settings, permission names, API addresses and data fields behind it. Closed: select the heading above to open it. While it is closed, your browser’s find-on-page (Ctrl+F or Cmd+F) does not search this part.

The Phishing Landing Route

The page behind the link in a practice email reads GET /public/phishing/l/:token, which carries no session or cookie and is rate-limited per network address. It returns only the giveaways, never a name or a simulation title, and answers an unknown link in the same shape as a real one. Everything else in Phishing Simulation, except a person reporting their own practice email, needs manage_phishing_simulation.

Related reference

Learning Paths, Imports & Exemptions

Policy Signing