To access the results of your vishing campaign, whether ongoing or completed, click the Campaigns tab in the Vishing module.
1 – Objectives
To know the key monitoring indicators for vishing campaigns
To understand the different statuses associated with phone calls and emails
To interpret the events collected during the campaign
2 – Prerequisites
Have an Arsen account allowing access to campaigns
Have launched at least one vishing campaign
Know the basic concepts behind campaign operation (call → email → possible clicks / compromise)
3 – Accessing vishing campaign tracking
Click Campaigns in the Vishing section of the main menu.
The central table displays campaigns grouped into three tabs.
3.1 – Determining the progress status of the campaign to review
3.1.1 – Active Campaigns
Groups all ongoing campaigns whose statuses can be:
Running: calls are still being made
Processing: all calls have been made, but the campaign remains open to collect behavioral events (email reactions, for example)
3.1.2 – Completed
Campaigns for which Arsen no longer collects data. These campaigns are finished.
3.1.3 – Archived
Previously archived campaigns.
3.2 – Accessing campaign details
To view the details of a campaign, simply click the name of the campaign you wish to analyze.
4 – Understanding vishing campaign data
The data collected in a vishing campaign is interpreted the same way as in a phishing campaign.
With three exceptions:
4.1 – Answered calls
Indicates that the employee picked up the call made by the AI. This event marks the beginning of the voice interaction.
This is displayed as a special status in the interface: Calls Answered.
4.2 – Call attempts
After three unsuccessful call attempts, the platform gives up on that target.
This results in a difference between the number of targets and the number of calls that connected (Calls Answered).
4.3 – Email delivery
In a vishing campaign, the Delivered status refers to the delivery of the email that occurs after the call, meaning after the Answered Call event.
5 – Example of an event sequence for a compromised employee
Here is what the logical sequence of events may look like for a compromised employee:
Calling… → call attempt
Answered Call → the employee picks up
Delivered → email sent and received after the call
Click → the employee clicks the link in the email
Compromised → credentials entered or compromising action performed
This sequence perfectly reflects the flow of a simulated vishing attack.
