Want your simulation to reach specific people at a time you choose, rather than being
spread across the campaign? Use Spear phishing instead.
Tagging and targeting
The first step is selecting your target audience, using the tags that are part of your organisation.
Country and Language are mandatory. Further narrowing is optional but usually worthwhile:
emails with more tags, targeting particular business functions or industries, tend to be
more effective.
Crafting the email
1
Choose the sender address
Pick from the list of available domain names and complete the text that goes in front of
it. Both text and placeholders can be used. Think about the purpose of your email and
which sender will draw the most interaction, because along with the subject line this is
the first thing the recipient notices.
2
Set the From Name
This is the name displayed as the sender in the mail list.
3
Write the email
The editor handles both HTML and CSS and plain text. JavaScript is not allowed.
4
Add an attachment, optionally
Attachments are text-based, meaning you write the name of the attachment only. All
attachments display as
.html, since that is the most common form in real phishing.If attachments are disabled for your organisation, this step stays visible, but the mail
is sent without the attachment. See
Exclude attachments.5
Add a landing page, optionally
You can create a page that corresponds with your email. It is automatically connected to
every link embedded in the mail.
6
Review
Check thoroughly for sensitive information, and confirm the layout is correct.
Layout is vital to whether a landing page works. If you are not going to invest time in
it, use the default tips page instead. A simulation loses credibility fast through
image-sizing problems and odd fonts.