Your first 30 days

This plan gets a new organization from an empty account to a running program in about a month. Each week ends with a check you can do yourself. The order matters: every step is cheap now and awkward to fix once people are receiving mail from the platform.

Week 1: your organization and your people

1. Branding. In HRS Learn, open /admin/brand-settings and set the Logo URL, Brand color, Default sender name, Reply-to address and Email footer. People trust mail that looks like it comes from you.
2. People. Connect your directory rather than uploading a file, so joiners and leavers stay correct without anyone remembering. See Bring your people in.
3. Departments. Make sure everyone has one. Reports are grouped by department, and people without one end up in a row nobody owns.
4. Leave out accounts that aren't people. Untick Enroll in training & risk program for service accounts, shared mailboxes and external consultants. They inflate your numbers and never complete anything.
5. Reporting lines. Import who reports to whom from /admin/people/managers, so repeated problems can reach a manager.
6. Sign-in. Set up single sign-on if you use it, and decide whether to require multi-factor sign-in for password users.

Check: open /admin/people and compare the count with your real headcount. A big gap usually means service accounts got in, or a group was missed.

Week 2: mail and reporting

1. Mail filters. Ask your mail team to allowlist HRS simulations. See Let practice phishing through your mail filters.
2. Report button. Deploy the Report Phishing button in Outlook. See Deploy the Report Phishing button. It can take a day to appear.
3. Report messages. In settings, review the Report acknowledgment wording people see after reporting, both for a practice email and for a real one.
4. A test of one. Assign a module to yourself, complete it, and pass the knowledge check.

Check: once the button appears, tell your security team you're testing, then report a harmless email from your own inbox with Report Phishing and confirm you see the acknowledgment. It reaches them like any other report. Then confirm your completed module shows on your dashboard. Your score updates the next morning.

Week 3: tell people, then take a baseline

1. Announce the program in your own words, from a person people know. Say practice phishing is coming, what to do with it, and that the aim is practice, not blame. See Run a fair security awareness program.
2. Run a baseline simulation before any training, so you have something to compare to. Spread delivery over several hours with Delivery pace.
3. Send yourself a test first. On the Review & launch step, select Send test to my inbox and check the email lands in the inbox with its link intact.

Check: a day after launch, open the campaign results. If nearly everyone "clicked" within seconds of delivery, a link scanner is still opening the links. See Clicks you didn't expect.

Week 4: train, then read the results

1. Assign the first training to everyone, with a due date far enough out to be fair. Reminders go out automatically.
2. Read the baseline as a funnel: delivered, opened, clicked, submitted, reported. Note your reporting rate as well as your click rate.
3. Look at repeat clickers once you have more than one campaign. They are where targeted training does the most good.
4. Set a rhythm. Decide how often you'll run simulations and short modules, and put the next quarterly review in the calendar.

Check: open the executive overview and make sure you could explain every number on it to your leadership. If one makes no sense, ask support before you present it.

After the first month

• Keep simulations steady rather than occasional. A monthly rhythm, spread over hours, is a good default.
• Use the executive overview and the reports for quarterly reviews.
• If you have HRS Exposure, verify your domains so exposure findings feed people's scores. See Monitor your domains.