Automated Phishing Simulation Follow-Up

When a user falls for a phishing simulation, sending a generic follow-up email rarely leads to real learning. With Automated Phishing Simulation Follow-Up, your users get personalized, timely feedback directly in their learning portal — showing them exactly how they responded and what they should have spotted. You get the learning outcome without the manual admin work.

Before enabling this feature

We want to ensure that your users get the best experience and get on to the platform as seamlessly as possible. So let your users know that they will receive email notifications from CyberPilot before simulation results become available for them. Do this before you turn "on" mail notifications. Here's a template that you can use:

"Dear colleagues
As part of our effort to combat the threat of phishing, we have teamed up with CyberPilot to do phishing training. Phishing training comes in the form of simulations, which are emails that resemble real phishing attempts and should be treated as real phishing.

We do this training in order to become better at spotting and handling phishing attacks.

Like with real phishing, we do not know when simulations will arrive, but you will be notified by CyberPilot via email after you have taken part in a simulation. You will be able to log into the CyberPilot platform and see your results and learn more about tactics used by cybercriminals to gain access and exploit users.

Kind regards,
IT"

How to enable the feature

Ensure that users can receive system mails.

Go to Account Settings → Email & Delivery

Here you must:

Uncheck Block system emails.

Go to Account Settings → Training Settings → Phishing.

Here you:

• Enable the feature — Now users can see the phishing simulation section in their learning portal. Disabled by default.
• Enable email notifications — Now users receive an automatic email when their result is ready. Disabled by default.

Remember to click Save training settings after making changes.

What your users see

Once the feature is enabled, a new phishing simulation section appears in your users' learning portal. It has three parts.

Your Performance

A summary of the user's overall phishing simulation statistics, including:

• Number of simulations received
• Number of times they clicked a link (compared to the organization average)
• Number of times they submitted data (compared to the organization average)
• Number of times they reported a simulation (compared to the organization average) — only shown if the phishing reporting feature is active on your account

Simulation Overview

A list of all phishing simulations the user has received, ordered by date with the most recent at the top. Each entry shows:

• Simulation title
• Sender name and address
• Date received
• The main phishing sign to look for
• The user's interaction: Reported, No Interaction, Clicked Link, or Data Submitted

Simulation Detail View

When a user opens a simulation, they are taken through an educational flow of up to four steps:

1. Explanation — the warning signs they should have noticed
2. Email preview — the simulated email they received, including the display name and sender address
3. Landing page — the landing page they were directed to
4. Redirect page — the final redirect page

Once the user completes the flow (or clicks back to the overview), their result updates from Not viewed to Viewed.

When results become available

Once a result becomes available, any later interactions from that user for that simulation are no longer registered — the result is locked in.

*see Q&A below

Email notifications

When email notifications are enabled, users automatically receive an email informing them that they were part of a phishing simulation and that their result is available in the portal.

• Users who interacted (clicked, submitted data, or reported) receive the notification 24 hours after their interaction.
• Users who did not interact receive the notification when their result becomes available after 3 working days.

First-time users receive a welcome email before their first result notification, explaining how to log in to the platform. This works the same way as for Awareness Training access.

Things to know

• If a user has no results available yet, the overview shows zeros and no simulation cards.
• Even if email notifications are disabled, results are still visible in the portal as long as the feature is enabled.
• Historic results are available as soon as the feature is enabled — users can see past simulations right away.

Q&A

Question: Why 24 hours and not instantly?

Answer: When analyzing user behaviour, we see that about 50% of those who end up submitting data or reporting an email do no do it instantly or within 5 minutes, but wait up to 24 hours after they first clicked the link. So the 24 hour window is to give user the change to do all the actions that they normally would before closing the window for interaction. The 24 hours cover 95% of all interactions on average.

Do you have questions?

Contact us at support@cyberpilot.io