Reviewing campaign data is essential to understanding employee behavior across your organization.
Human vigilance can become the first firewall of your company.
To do this, three conditions must be met:
Ensure employees have the theoretical knowledge required to recognize a threat.
Ensure they apply this knowledge when facing a real, sometimes subtle threat.
Ensure they become proactive in reporting suspicious activity.
1 – Objectives
Understand the evolution and results of a phishing campaign
Analyze employee behavior when exposed to threats
Measure the overall performance of a campaign
Identify improvement areas to strengthen human security
2 – Prerequisites
Access to the Phishing Simulation module
At least one campaign completed or in progress
Necessary rights to view detailed campaign data
3 – Access campaign data
3.1 – Access the campaign list
Click Campaigns in the Phishing section of the left-hand menu.
Campaigns are sorted in three tabs: Active, Completed and Archived. You can also search for a campaign by name or filter the list by Type. The Recurring tab lists automated campaigns.
3.2 – Open a campaign’s data
Click the campaign name to view all associated information.
The header summarizes the campaign: number of scenarios, number of targets, launch date, Failure mode and After failure (what happens once an employee falls for the simulation, for example a redirection or just-in-time training).
4 – View the campaign timeline
Review the timeline at the top of the page to understand the different statuses the campaign goes through:
Scheduled: the campaign is planned
Sent: emails are being sent, within the planned sending period
Collecting results: employees can still interact with the emails. The number of days left and the date of the automatic computation are displayed
Completed: the results are final and a summary of the clicks, submitted credentials and reports is displayed
💡 Good to know
While a campaign is in the Collecting results status, results are computed automatically on the date displayed. Click Compute results only if you do not want to wait for that date.
5 – Read campaign data
5.1 – See how targets responded
The How targets responded card shows one square per target, sorted by the most serious reaction:
Gave credentials
Clicked
Opened only
Not opened
Reported, marked on the squares of the targets who reported the email as suspicious
5.2 – Analyze reaction times
The Clicks vs reports since delivery chart plots, over time since delivery, the number of employees who clicked, who gave their credentials and who reported the email. Above the chart, the key figures tell you within how much time half of the clicks happened, and how long after clicking half of the employees gave their credentials.
5.3 – Compare scenarios
The Breakdown table gives, for the whole campaign and for each scenario, the percentage of employees who opened the email, clicked, gave their credentials and reported it. The colors go from better to worse results, and scenarios that reached too few employees are not compared until you click Show it.
5.4 – Check the delivery
The Delivery card shows the number of emails delivered, the number of bounces and how long the sending took.
📚 Note
Two types of bounces exist:
Hard bounce: the email can never be delivered
Soft bounce: the email is temporarily undeliverable; another attempt will be made
⚠️ The bounce counter is cumulative, even if the email is eventually delivered.
5.5 – View the security score
Once the campaign is Completed, the Security score obtained for this campaign is displayed next to the timeline, out of 100.
6 – View a collaborator’s event history
6.1 – Browse the targets
The Targets table lists every employee of the campaign, with their groups, the scenario they received and their Journey, a visual summary of how far the employee went in the campaign.
Use the All, Clicked, Gave credentials and Reported tabs to focus on a behavior
Click
More filtersor use the search bar to find a name, an email, a group or a scenario
6.2 – Access detailed user activity
Click a target to open the detail panel and see all the actions this collaborator performed during the campaign:
the exact time of each event: sent, delivered, opened, clicked, credentials submitted, reported, with the delay since the previous step
Expand allto display the details of every eventPreviewto see the email the collaborator receivedthe arrows, or the J and K keys, to move to the next or previous target
7 – Export campaign data
7.1 – Export the campaign
The campaign must be in Completed status.
Click Export CSV at the top right of the page: the file is a structured spreadsheet of the campaign results.
7.2 – Export a list of targets
Under the Targets table, click Export this list to export only the targets currently displayed, for example those who gave their credentials.
The ⋮ menu next to Export CSV lets you Archive the campaign once you no longer need it in the Active or Completed lists.