This article explains how phishing scenarios work, how they are used to evaluate employees, and the available actions in the scenario library.
1 – Objectives
Filter and navigate the list of scenarios
Select or create scenarios adapted to your organisation
2 – Prerequisites
Admin-level permissions to manage scenarios
Access to Phishing Simulation →
Scenarios
3 – Understanding what a scenario is
3.1 – Definition
A scenario is used to evaluate an employee up to the point of potential compromise.
Compromise occurs when the user enters their credentials into a fake landing page.
3.2 – Components of a scenario
A scenario always includes two elements:
A phishing email containing a malicious link
A landing page designed to capture credentials
3.3 – Using the scenario library
The scenario list acts as a library of realistic simulations.
The effectiveness of a campaign relies heavily on scenario selection: the more credible and contextualised the scenario is, the harder it will be to detect.
To access the library, click Scenarios under Phishing Simulation in the left navigation menu.
4 – Filter and search for a scenario
4.1 – Use filters
Filter the scenarios to display only those relevant to your internal environment.
Filters may include:
Language
Difficulty level
Vendor (industry, service type, or associated digital ecosystem)
4.2 – Search by name
Use the search bar to quickly locate a specific scenario.
4.3 – Access custom and favorite scenarios
Click
My Scenariosto display duplicated or edited scenariosClick the
star iconto add a scenario to your favorites
→ Favorited scenarios automatically appear at the top
5 – Available actions on a scenario
The library provides 5 key actions:
Add to favorites (click the star)
Preview the phishing email
Preview the credential-harvesting landing page
Preview the training page (used in Training Campaigns after compromise)
Duplicatea scenario to customise it
6 – Create a new scenario
If you are comfortable with HTML/CSS:
Go to
My ScenariosClick
Create a new scenarioBuild:
the phishing email
the landing page
all required components
7 – Understanding scenario difficulty levels
7.1 – Available difficulty levels
Scenarios are classified into three categories:
Easy
Medium
Hard
7.2 – Factors influencing difficulty
Several factors impact how difficult a scenario is to detect:
Credibility of the sender domain
URL subtlety on the landing page
Presence or absence of spelling errors
Simulated suspicious login from an unexpected country
Similarity to tools used internally
Urgency of the message (urgency increases compromise rates)