The Phishing Simulation module helps your organization identify and measure the vulnerability to phishing attacks present within your organization. You can deploy phishing campaigns for multiple organizations in bulk.
Steps to Create a Phishing Campaign
Prerequisites
Before you create a phishing campaign, ensure the following requirements are met:
- You must have an activated SMB organization.
- You must create at least one group or synchronize with any directory (refer to the Targets & Groups Introduction section below).
Targets & Groups Introduction: The BullPhish ID Targets & Groups module allows you to create and manage targets (training recipients) and add them to groups. You can create targets before adding them to a group, or they can be manually imported from a CSV file while creating a group. Once added, you can also edit or duplicate an existing group. Groups can use the Phishing Simulation and Training & Awareness modules.
Note:
- Modifications to a group will not affect the campaigns that are in In Progress status because group information is synced right before a campaign is processed. Changes made to a group will be reflected in new or scheduled campaigns.
- The statuses listed below are considered to be In Progress:
- Processing, Sending Emails and Running Campaign Statuses.
A campaign will send a premade kit, which includes an email template, a landing page, and a sending profile, to a group of targets over a specified date range.
To start, follow the below instructions:
- Log into your BullPhish ID account.
- Navigate to the left-side panel and select Create Phishing Campaign under Phishing Simulation.
Create Phishing Campaign
1. Details
- Details & Descriptions: Enter the new campaign details as defined below.
- Campaign Name: Enter a name to define your campaign.
- Description (optional): You can recognize the campaign more easily by adding a description.
- Campaign Start Date: This is the start date and the time your campaign will send emails. Your current date is automatically prefilled in the Campaign Start Date field. The prefilled Start date is the current date; however, the prefilled start time is always 9:00 AM.
- Skip Weekends: Select this check box option if you want to send campaigns during work days and not on weekends), meaning targets will not receive any phishing emails over weekends.
- Spread: Here, you can specify the date range in which the phishing emails will be sent to all users. The options available in the Spread dropdown list are the following:
- All At Once: Campaign emails will be sent all at once at the selected starting date & time.
- Send Over One Day: Campaign emails will be sent periodically over the course of one day.
- Send Over the Next 3 Days: Campaign emails will be sent periodically over the course of three days.
- Send Over the Next 5 Days: Campaign emails will be sent periodically over the course of five days.
- Send Over the Next 7 Days: Campaign emails will be sent periodically over the course of one week (seven days).
- Send Over the Next 14 Days: Campaign emails will be sent periodically over the course of two weeks (fourteen days).
- Send Over the Next 30 Days: Campaign emails will be sent periodically over the course of 30 days.
- Spread: This option allows you to choose the time frame in which the campaign will be sent. There are two instances of Spread:
- If you select the "All at Once" option under Spread, the time will auto-populate to 9:00 AM on the dropdown. Or else you can choose Start Time manually.
-
- If you select any other “Send Over the Next" option under “Spread,” the Hours to Send field will appear, and the time will auto-populate to 9:00 AM on the left and 5:00 PM on the right dropdown fields.
Once you fill in all mandatory fields, click Next, and the tab will take you to the Recipients tab.
2. Recipients
2. Organization Details:
The organization table defines the recipients of the campaign.
- Steps to Add Organization:
- Click Organizations dropdown to view the list of organizations.
- Select organization using a dropdown list and select a set of Groups from the table. Then, identify a time zone using the dropdown list.
-
- Organizations selected within the Organizations dropdown will appear on the table below.
- Each row on the table will display the organization selected, a dropdown for groups unique to the organization, and a dropdown to select a time zone.
-
Groups dropdown includes the number of users receiving the campaign for each group.
- When you select all groups, the field displays the list of group numbers that you are selected. Once you select all groups, you can still deselect one or more groups from the list.
-
Note: If you select a list of 100 groups, the checkboxes will get disabled, and you will see the following message: The max number of groups have been selected. To add more groups for this organization, please create a new campaign.
-
- You can select a specific Time Zone using dropdown functionality. The campaign will be delivered to the user based on the selected time zone.
Note: Time Zone is automatically set to the time zone of the user creating the campaign.
-
- Click Next will take you to the Kits tab.
Note: When numerous organizations are added within the recipients step, an informational banner with the following message appears at the top of the page: By adding organization(s), You can only access global and custom kits available to the selected organization(s).
- Remove Organization:
- To remove an organization from the table, click the Delete icon. Before you make any changes, please note the organization will be removed from the table without a confirmation modal.
3. Kits
3. Kit Selection:
On the Kit selection page, you must first define the frequency and add your kits to the campaign by dragging and placing them to the right. Global kits and custom kits available to the selected organization will be available on this tab.
Note: Only one kit can be assigned per frequency.
a) Frequency: (The rate at which Phishing Simulations will be sent.)
Frequency is a mandatory field and defines how often your campaign will recur. You can choose the frequency of emails using the Frequency dropdown list. Five options appear on the list: Once, Weekly, Biweekly, Monthly, and Quarterly. For example, if you select a Biweekly frequency, kits will be scheduled to be sent out once every two weeks and will be reflected on the kit selection table.
b) Language: By default, US - English will automatically be selected under the Languages dropdown list, and all kits in English language will get fetched. Otherwise, you can choose the desired language from the dropdown list.
c) Select Kit: The Search Kits section includes all available kits for the selected organization. You can add your kits to the campaign by dragging and placing them on the right table. The following briefs you on the action icon functionalities:
- You can search kits by name using the search bar.
Pinned Kits will be at the top of the list for easy access.
The preview mode of each kit is available for users. Once you click the preview icon (eye icon), the page will redirect you to the specific phishing kit page; where you can view the Email Template and Landing Page of the chosen kit.
-
This is a hot icon; if you check this filter icon, only hot kits will be displayed on the screen. This feature shows the hot kits for two weeks from the date of selection. Additionally, you can fetch kits by applying the Only hot filter.
Once you select the frequency and add kits to the campaign, the selected frequency option will be reflected on the Kit selection table, with the Delivery date reflecting the date range of Spread and Active until.
For example, if the user selects Biweekly, the items under the frequency (refer arrow) will reflect Biweekly.
Clicking Next will take you to the Review tab.
4. Review
4. Review Campaign:
You can review the campaign and make changes using the edit icon (pencil icon). For example, if you want to add and remove organizations, click the edit icon next to Recipients; the page will redirect you to the Recipients tab.
Once you have configured your Phishing Simulation Campaign, click the Confirm button.
As soon as a Campaign is successfully created, you are automatically taken to the Phishing Simulation Campaigns dashboard. This page can alternatively be viewed by clicking View All Campaigns from the left-side navigation bar.
Here is a quick look for you.
Once you click Confirm and are taken back to the View All Campaign page as campaigns are being created, there will be a wait time for the campaigns to be presented on the table.