Measure your organization's real risk with a concrete test, instead of estimating it with a survey.
Detect who should be trained first, with name and area, instead of training everyone equally.
Turn the mistake into learning at the exact moment: whoever falls for it can automatically receive an assigned course, when the topic is fresh.
Maintain a comparable timeline, to see if the risk decreases simulation after simulation.
Test without consequences before going live, with test mode.
Go to the calendar and create the launch
In the side menu, Awareness → Simulations. This opens the Launch Calendar. From there you have two paths: the New Launch button at the top right, or the + below the month in which you want it to go out.
Choose Email among the four types. QR and Smishing have their own flow, and USB Drop is not yet available: if you choose it, a notice opens to contact the team.
This opens New email simulation, a four-step wizard: Basics, Configuration, Template, and Sending.
Each step saves automatically. Once the first step is finished, the simulation is already kept as a draft. If you close the browser halfway through, you don't lose anything: you'll find it in the calendar with the DRAFT label and you can pick it up again. A draft doesn't send anything.
Step 1 — Basics
Simulation name — this is internal, to recognize it later. The recipient of the email doesn't see it. Example: "Q1 Awareness".
Language — the language of the email content. Choose it carefully: afterward you'll only be able to choose templates available in that language.
Audience — who receives the simulation. You have All employees, which takes all active ones, or Custom selection, which opens a search tool where you combine employees, departments, and teams into a single audience. There you'll see three numbers: total users, reachable, and excluded. The Suggested audience option appears but is not yet available.
Test — check this box if it's a trial run. This changes two things: the sending is fixed as "Send now" and cannot be modified, and afterward you'll be able to delete it even if it already has results.
Step 2 — Configuration
Recommendation page — required. This is the page the person sees after falling for it, with security recommendations. This is the moment of greatest attention in the entire exercise.
Training assignment — optional, comes disabled. If you enable it, whoever falls for it is automatically assigned a course or a learning path, with a deadline to choose: 1 week, 2 weeks, or a number of days.
Step 3 — Template
Step 4 — Sending
First, when it goes out. There are three modes:
Time period — emails are distributed between a start date and an end date. You also choose the daily window (all day, business hours from 9 to 6, morning from 6 to 12, afternoon from 12 to 6, or evening from 6 to 11), the time zone, and whether to include weekends. This is the most realistic mode: a real attack doesn't arrive all at once.
Specific date — everything goes out on the same day, at the time you choose.
Send now — goes out immediately.
Then, from which address it's sent:
Sender — the name the person sees in their inbox.
From — the user and domain from which the email is sent.
The domain is preloaded from the template and may not be one of yours. Templates come with a suggested domain that your company might not have assigned. If the one shown is not among yours, the simulation won't be able to be sent until you choose a valid one. This is intentional: it prevents an email from going out from a domain that doesn't belong to you.
Review and send
Before sending, Review and send opens, with the summary: name, reachable users, assigned training, when it goes out, the recommendation page, and the email preview. If something is wrong, Cancel returns you to the wizard without losing anything.
Upon confirming with Send, the simulation is launched and you return to the Launch Calendar, where you'll already see it. If the sending fails, The campaign could not be launched. Review it and try again. appears, and the simulation remains as a draft.
It can't be edited, but from the calendar you can stop it. A stopped campaign can be resumed later by indicating a new end date, which must be in the future.
The language from step 1 filters the available templates. Go back to step 1 using the wizard's back button and change it: you won't lose what you've already entered.
They see the recommendation page you chose in step 2. If you enabled training assignment, they're also assigned the course or path with its deadline, without you having to do anything.
To practice without cluttering your metrics. It goes out immediately and afterward you can delete it even if it already has results, something that isn't possible with a normal simulation.
The template brought a domain that your company doesn't have assigned. Open the domain selector in step 4 and choose one of yours. If none appears, ask your Whalemate contact to review your account's domains.
