Reviewing campaign data is essential to understanding employee behavior across your organization.
Human vigilance can become the first firewall of your company.
To do this, three conditions must be met:
Ensure employees have the theoretical knowledge required to recognize a threat.
Ensure they apply this knowledge when facing a real, sometimes subtle threat.
Ensure they become proactive in reporting suspicious activity.
1 – Objectives
Understand the evolution and results of a phishing campaign
Analyze employee behavior when exposed to threats
Measure the overall performance of a campaign
Identify improvement areas to strengthen human security
2 – Prerequisites
Access to the Phishing Simulation module
At least one campaign completed or in progress
Necessary rights to view detailed campaign data
3 – Access campaign data
3.1 – Access the campaign list
Click Campaigns in the Phishing Simulation module.
3.2 – Open a campaign’s data
Click the campaign name to view all associated information.
4 – View the campaign timeline
Review the timeline to understand the different statuses the campaign goes through.
5 – Read campaign data
5.1 – View key indicators
Access the summary table showing:
Total number of targets
Total number of delivered emails
Total number of bounced emails
📚 Note
Two types of bounces exist:
Hard bounce: the email can never be delivered
Soft bounce: the email is temporarily undeliverable; another attempt will be made
⚠️ The bounce counter is cumulative, even if the email is eventually delivered.
5.2 – Analyze employee interactions
Review:
Number of email opens
Number of clicks
Number of compromises (credentials entered)
Number of phishing reports
5.3 – Analyze reaction times
View average and median metrics for:
Time between email delivery and click
Time between email delivery and compromise
Time between click and compromise
5.4 – View the security score
Check the security score obtained for this campaign.
A dedicated link provides details on how it is calculated.
6 – View a collaborator’s event history and password entropy
6.1 – Access detailed user activity
Click the collaborator’s name to see all actions they performed during the campaign.
6.2 – View event information
For each event, review:
Exact date and time
Event details via
Show Payload
For compromise events, you can view:
Password strength (weak, medium, strong)
Password entropy estimating the time required to brute-force it
7 – Export campaign data
7.1 – Access the export
The campaign must be in Completed status.
Click Export Campaign when it becomes available.
7.2 – Choose the export format
Two formats are available:
CSV file (structured spreadsheet format)
PDF consolidated report
