Creating a campaign

A campaign is built in four steps. The third is where the first run fails technically, the fourth is where it fails politically.

Steps

1. Set the target group. A group from the directory, not the whole workforce. The first campaign runs small.
2. Choose a template or take over a defused real attack from the account's pool.
3. Allow-list the sending path, so that your own protection does not intercept the exercise message.
4. Set the period and spread delivery over it instead of sending every message in the same minute.

Allow-listing the sending path

If the simulation's sending path is not allow-listed, your own protection holds the exercise messages. The campaign then measures the filter's detection rate instead of the people's, and the click rate stays at zero.

This is the most common mistake in a first run. A campaign with a rate of exactly zero is therefore checked here first, not at the template.

Settle before the first run

• Who sees the results. That belongs before the run, not after. See results and data protection.
• Whether employee representation has been consulted. A surprise campaign creates trouble that falls back on IT.
• Which languages are spoken in the organisation. Without a lesson in the person's language, no assignment is made.

Rhythm

One run per quarter for the workforce is a workable cadence, plus occasion-based runs for groups at higher risk such as accounting and management. More often is perceived as harassment, less often has no effect.

Independently of that, the baseline training runs for everyone at the interval from the configuration, every 90 days by default. That way even those who never fall for an exercise keep learning.