For the Whalemate simulation emails to arrive properly (and not get lost in spam), it is necessary to create exceptions in Google Workspace.
Button that integrates into Gmail and allows the organization's collaborators to identify and report suspicious phishing emails directly from their inbox.
Integration with Google Workspace allows you to import and keep a company's employees synchronized directly from its Google directory.
Functionality that allows configuring the sending of Whalemate emails (Academy, trivia, and awareness campaigns) using a client's Google email account as the sender.
To ensure that Whalemate's simulation emails arrive properly (and don't get lost in spam), you only need to create some exceptions in Microsoft.
Button that integrates into Outlook and allows the organization's collaborators to identify and report emails suspected of phishing directly from their inbox, through an Office add-in installed at the organization level.
Functionality that allows automatically synchronizing payroll data (employees and groups) from Microsoft Entra ID to Whalemate, using the standard SCIM protocol.
Functionality that allows configuring the sending of emails for the Academy and trivia using a domain client's own email domain through integration with Microsoft.
Screen where administrators define how the phishing report button behaves: who receives the reports, what messages the collaborator sees, and what happens to the reported email.
Allows loading and keeping the company's employee roster up to date by uploading a file with the Whalemate template, without the need to connect an integration (Google Workspace, Azure AD, or Okta).
Functionality that allows automatic synchronization of payroll data (employees and groups) from Okta to Whalemate, using the standard SCIM protocol.
Smart Groups allow you to create employee segments using natural language. Instead of building manual filters, you describe who you want to include and the AI generates the group automatically.
A group brings together several collaborators under a name, so they can be used as the audience for a campaign or a training without selecting them one by one each time. In addition, a group can mark a risk level that is transferred to its people.
Allows creating and managing QR code attack simulations. The administrator configures a QR campaign that, when scanned, redirects the employee to a controlled fake page, measuring who interacts with the deception.
Edit and manage the content of the page an employee sees when they fall for a Phishing, Smishing, or QRishing simulation yourself, without depending on the Whalemate team to make changes.
A phishing email simulation is a fake email you send to your team to measure who falls for it. It's set up with a four-step wizard and, if you want, it automatically assigns a course to anyone who takes the bait.
The screen where you see all your simulations month by month, what state each one is in, and where you create new ones. It covers the current month and the next five.
Before assigning a course, you can go through it completely from the dashboard: its sections, the videos, the texts, the exercises, and the quiz questions, just as your people will see them. From here you can also copy its direct link and download its index in PDF.
A learning path is a sequence of courses that the employee goes through in order. From Academy → Learning Paths you can see the ones available to you, view what each one is made up of, and manage who is enrolled.
Mass course assignment allows you to assign multiple courses to multiple users or audiences at the same time, streamlining training management within the platform.
This is the results screen of a trivia quiz: how many people have played it, how many have it pending, the average score, and the leaderboard with each person's score.
In the Courses and Learning Paths listings, content is automatically filtered and displayed according to the company's default language setting, making it easier to identify and select the correct material.
Administrators and training teams can freely reorganize the order of sections within a custom course.
Bulk enrollment deletion lets you select and remove multiple enrollments at once within the Academy module, making it easier to manage courses and learning paths at scale.
Create and manage your own courses within the Whalemate Academy: video sections, written lesson, and quiz, in the language of your choice. Once saved, it is published and ready to be assigned.
Direct link to an Academy course that the administrator can copy and share (for example, in a newsletter). When clicked, the collaborator arrives directly at the course, with automatic enrollment if not already enrolled.
Create a quick knowledge check (image + question) to reinforce a specific safety message, with tracking of opens and responses, without the need to assign it or enroll anyone.
This feature lets you configure the global behavior of quizzes within Academy, applying the same rules to every quiz in the organization.
This functionality allows you to define a global minimum passing percentage for the academy's quizzes, applicable to all courses in the organization from a single centralized configuration.
It is a configuration that allows enabling or disabling the automatic sending of emails when courses or learning paths are assigned to users.
It's the screen where you see who is enrolled in a course and how each person is doing, and from which you enroll someone new, extend deadlines, or cancel enrollments.
The screen where you see who has a trivia assigned, with which dates and whether they already completed it, and where you enroll more employees or remove an enrollment.
From the detail of a route, you enroll the people you choose; from Bulk Assignment, you assign several routes to several people at once. The two handle differently those who already have the route assigned.
How to set up a trivia — how many questions it has, which categories they come from, and which email is used to send invitations —, add your own questions to the bank, and why a trivia that has already been assigned cannot be edited.
This is the summary of the emails your team members reported using the report button: how many were received during the period, what resolution status they are in, how they were classified, and how they break down week by week.
An indicator that measures each user's risk level based on their behavior in simulations and awareness actions. It is the calculation engine behind every risk view in the platform.
Main organization risk dashboard. It shows the company's risk score, its distribution by department and group, the evolution history, and the Historical PAS (Phishing Awareness Score).
Comparative view of your organization's awareness performance against your industry average or Whalemate's global average, with six KPIs, status indicators, and the gap per metric.
Centralized view of all awareness resources sent to the organization's employees, with delivery and open metrics per send.
The Academy Analytics dashboard offers a comprehensive view of your organization's training status, showing risk, progress, and assignment coverage in a single panel.
The Academy's Audit Log allows you to view and audit the status, progress, and certifications of all employees enrolled in courses and learning paths.
This view lets you consult the full detail of a simulation campaign, including its general information, aggregate metrics, and the list of events generated by users.
Configure how long a user session can remain active before automatically closing. This option is available to enterprise administrators from the Security section.
In Settings → General you define how your brand looks in your employees' portal and on their certificates, what your access address is, and who receives campaign alerts and expiration reminders.
Allows administrators to publish a security policy in PDF format for collaborators to read and formally accept from their Academy portal. Each acceptance is immutably recorded with name, date, UTC timestamp, and IP address.
Who did what and when regarding a defined list of administrative actions: logins, failed attempts, management of users and collaborators, campaigns, and Academia. With the before and after of each change, and exportable to CSV.
Single Sign-On (SSO) with Okta allows users to access the platform using their corporate Okta credentials, without the need to remember additional passwords.
Step-by-step guide for obtaining the necessary credentials from Auth0 and completing the SSO configuration in Whalemate.
Allows you to replace the Client ID, Client Secret, and/or Domain of your Auth0 SSO configuration directly from Whalemate, without needing to contact support.
The platform implements automatic protection against brute force attacks on authentication endpoints. If multiple failed attempts are detected from the same IP or user, access is temporarily blocked.
From Settings → Users, you add the people from your organization who will manage Whalemate, and define the access level each one has.
How you set your password the first time you access the admin panel, and what to do if you forgot it, if the email link has already expired, or if you can't log in.
This is the main screen of your portal. It brings together all the courses and learning paths assigned to you, along with the status of each one and the deadline for completing it.
When you finish a course or a learning path, Whalemate generates a PDF certificate with your name that you can download at any time.
How to work through an assigned course: the sections, the videos, the final quiz, and what happens when you finish it.
It's your personal page within the portal. It brings together your data, your achievements, your training statistics, your risk score, and all your certificates.
How to access your training portal: with a link sent to you by email or with your company account. You don't need to create or remember a password
Trivia is a question-and-answer game about digital security assigned to you by your company. You play against the clock, earn points, and compete with the rest of your colleagues on a ranking.
A learning path groups several courses into an ordered sequence. You complete it lesson by lesson, and as you progress, the next one becomes available.
A Quick Check is a single-question knowledge check about security, sent to you via a link. It takes less than a minute to answer and there's no need to search for anything within the platform.
Outgoing webhooks allow you to connect Whalemate with your own tools to receive automatic real-time notifications whenever an event occurs in a simulation campaign.
Allows external security events to be injected into Whalemate associated with a collaborator. Each recorded event directly impacts their Human Risk Score, just as if it had occurred within a platform simulation.
Guía para ejecutar cursos de Whalemate en su LMS mediante paquetes SCORM, manteniendo el seguimiento de progreso, calificaciones y estado de aprobación.
Guia para executar cursos do Whalemate em seu LMS por meio de pacotes SCORM, mantendo o acompanhamento de progresso, notas e status de aprovação.
Public API to report phishing emails from external systems.
Courses and learning paths
Catalog of awareness resources ready to send to your team members: images, PDFs, and videos by topic, with the available formats and languages for each one.
Catalog of ready-to-use phishing simulation templates: 417 templates by topic, with the language and attack type of each one (link only, credential delivery, or ransomware).
