How tests work

What a test is

A test is a fake phishing email that OutPhish sends to one of your staff. It looks like something a scammer might send, such as a shared document, a password warning, an invoice or a parcel notice. It asks the person to click a link, scan a QR code or open an attached PDF.

If they follow it, they land on a fake sign-in page. Nothing harmful happens. OutPhish records what they did, tells them it was a test and asks them to do a short training refresher. See What staff see.

Who gets tests

Every active staff member on your Staff page gets tests. Archived staff don’t. See Add staff.

When tests go out

There are two ways to send tests:

• Scheduled tests. Once you switch on Scheduling on the Campaigns page, each active staff member gets one test in every period you choose: daily, weekly, monthly or quarterly. See Schedule tests.
• One-off tests. You can send a test to one person at any time from the Staff page. See Send a test now.

Scheduling is off when your account is created. Nothing goes to your staff automatically until you switch it on and save.

Each person’s scheduled test arrives at a random time within the period, so staff get theirs at different times. Tests aren’t limited to working hours. One can arrive in the evening or on a weekend.

How the emails are made

Each test email is either written by AI or built from a ready-made template. By default it’s about half and half.

• AI-written emails are written fresh for each person, using what OutPhish knows about them and your organisation.
• Template emails come from a library of ready-made emails. They imitate well-known services, such as Microsoft 365, Google, DocuSign, PayPal, Zoom and LinkedIn, and internal messages from an IT or HR team. You choose which templates your organisation uses. See Choose email templates.

The test can be a link in the email, a QR code in the email, or a PDF attachment with a link or QR code. You set the mix. See Test formats.

OutPhish tells the AI to invent its senders rather than impersonate real, named people, and never to write romantic or sexual emails.

What’s personalised

When your account is set up, OutPhish searches the web for public information about your organisation. If it’s sure it has found the right organisation, it saves a short description and details such as your services, locations, key people and the suppliers you mention. You can check and edit this on the Settings page under Organisation Description and Additional Data Points. See Organisation settings.

How much an AI-written email uses depends on the person’s difficulty level:

• At low levels, emails are generic and have obvious warning signs.
• As the level rises, emails use more about the person and your organisation: their name and role, then your organisation’s name, email address and location, then your organisation description.
• From level 9, emails can also use a few extra details picked at random. These include colleagues’ names and roles, your research details, the current date and time, your number of staff and the date the person was added.
• At level 20, the email is meant to have no obvious warning signs at all.

Template emails fill in details such as the person’s name and your organisation’s name, plus made-up details such as dates and reference numbers.

Tip

Enter each staff member’s role when you add them. AI-written emails use it from level 3.

Difficulty levels

Each staff member has a difficulty level from 0 to 20. You can see it in the Difficulty column on the Staff page. New staff start at 0.

• The level goes up by 1 each time a scheduled test is planned for them, until it reaches the Maximum difficulty you set on the Campaigns page.
• Clicking a test link lowers it by 5 (but not below 0).
• Entering details on the fake sign-in page drops it back to 0.

One-off tests use the person’s current level but don’t raise it.

What OutPhish records

For each test, your reports show the furthest the person went:

• Ignored: no open or click was recorded.
• Opened: the email’s images loaded. Many email programs block images, so treat opens as a rough guide.
• Clicked: the person opened the link or scanned the QR code, and the fake sign-in page loaded.
• Compromised: the person pressed the sign-in button on the fake page. What they typed is never sent to OutPhish.

Each result is recorded once per test. OutPhish tries to ignore automatic link checks by email security tools. A click within six seconds of the email being sent isn’t counted, and neither is a sign-in with no mouse or keyboard activity.

OutPhish doesn’t record when a staff member reports a test email.

See Read your reports.

What happens after a click

About a minute after someone clicks or signs in:

• They get a Phishing Test Feedback email. It shows the test email, explains the warning signs and links to a training refresher. Their training is marked as not done until they finish it. See Staff training.
• Everyone in your account with the Organization Admin or Campaign Manager role gets an Employee Phishing Test Result email. See Users and roles.

Plans

• Free plan and paid plans: every phishing feature is included, including scheduled tests. Your active staff must be within your plan’s capacity. The Free plan covers up to 15 active staff. If you have more active staff than your capacity, you can’t switch on scheduling, and tests (including one-off tests) aren’t sent until you archive staff or increase your capacity. See Staff and your plan.
• 14-day free trial: you can look at your campaign settings but not save them or switch on scheduling. You can send one-off tests to up to 2 staff. See Subscription and billing.