Simulation questions

Do we need to allowlist anything?

Yes, once, before the first campaign. Without it, simulations land in junk and link scanners click the links. See Let practice phishing through your mail filters. The exact values for your account are in HRS Learn, on the campaign's Review & launch step and in settings under Sending domains & delivery.

Can I send a test to myself first?

Yes. On the Review & launch step, select Send test to my inbox. It goes only to you. Check it lands in the inbox and that the link hasn't been rewritten by a scanner.

How do I keep some people or addresses out of every simulation?

Add them to the Do-not-contact list in phishing settings (/admin/phishing/settings in HRS Learn). The sending engine never sends a simulation to an address or domain on that list, in any campaign or autopilot program. Use it for executives' assistants who handle real invoices, shared mailboxes, or anyone your organization has agreed to exclude.

Who can a campaign go to?

Everyone, a Department, a Group or One person, chosen on the Review & launch step.

Should we send to everyone at once?

We'd advise against it. The first person to spot it tends to warn everyone else, which makes the result look better than it is. Use Delivery pace to spread delivery over 1, 2, 4, 8 or 24 hours, or set Emails per minute.

Can we send by text message or Microsoft Teams?

Email is the standard channel. SMS and Microsoft Teams appear as delivery channels, but each needs setup with HRS and your Microsoft or messaging admins before it can deliver. Contact support before planning a campaign on either.

What kinds of lure can we use?

On the Email step, the Delivery vector can be a Link, a QR code, an Attachment or an OAuth consent request. The Experience step decides what opens after a click: a short lesson, or a practice sign-in page followed by the lesson.

Is anything typed into a practice sign-in page stored?

No. The page records that a form was submitted and throws the contents away.

What counts as a click?

A person following the link, scanning the QR code or opening the attachment. Visits that look automated, such as link scanners and link previews, are not counted. Click and report rates are worked out against people whose message didn't bounce, and each person counts once however many times they click. See Clicks you didn't expect.

Someone clicked and then reported. How is that counted?

As both. A person can click, submit and report in the same campaign. Reporting still counts in their favor, which is the behavior you want after a mistake.

How long should a campaign stay open?

Longer than you think. Reports keep arriving for days. Set an End date if you want results to settle at a fixed point, and read the results after it.

Is there a limit on campaigns?

Your plan sets a monthly number of campaigns. If you reach it, starting another tells you how many you've used, and you can upgrade or wait until next month.

Can we run simulations continuously instead of one at a time?

Yes. Phishing autopilot (/admin/phishing/autopilot in HRS Learn) plans an annual program rather than single campaigns. The do-not-contact list applies to it too.

Where do we see results?

On the campaign's results page, and across all campaigns under Phishing → Analytics. Both can be downloaded as CSV. Results also feed each person's ShieldScore overnight.