Skip to content
OutPhishOutPhishOutPhish Help

What OutPhish does

A phishing email is a fake message that tries to trick someone into clicking a link, opening an attachment or typing in a password. OutPhish sends your staff realistic practice phishing emails. If someone falls for one, they find out straight away and get short training. You see the results in reports.

The practice emails are safe. Their links lead to OutPhish’s own practice pages, and nothing a staff member types into a practice sign-in page is kept.

Your staff don’t need an OutPhish login. Tests, feedback and training all reach them by email.

How it works

Section titled “How it works”
  1. You add your staff. Each person gets a welcome email explaining that your organisation uses OutPhish for security awareness training. See Add staff.
  2. You let OutPhish’s emails through. Whoever looks after your email adds OutPhish’s sending servers to an allow list, so tests aren’t blocked. See Allow OutPhish emails.
  3. You choose how often staff are tested. In Campaigns you pick an Email frequency (daily, weekly, monthly or quarterly) and switch on Scheduling. Tests then arrive at random times in each period. Nothing is sent automatically until you switch Scheduling on. See Schedule tests.
  4. Staff receive tests. Tests look like everyday work emails. Some are written for your organisation using details OutPhish looks up about it online. Others come from ready-made templates, and you choose which templates can be used. A test can carry a link or a QR code, in the email itself or in an attached PDF. See How tests work and Test formats.
  5. Someone clicks. The link opens a page that looks like a Microsoft 365 or Google sign-in page. If they type in their details and submit, they see a page explaining it was a learning exercise. Shortly afterwards they get a feedback email showing the clues they missed, with a link to training. Your organisation admins and campaign managers get an email saying who it was. See What staff see.
  6. Staff do the training. It’s a short online course with lessons and a quick assessment. Staff who finish get a certificate by email. You choose whether training happens only after a failed test, or also once a year. See Staff training.
  7. You check the results. Reports shows who opened, clicked or entered details, how that changes month to month, and who needs attention. Organisation admins also get a monthly report by email. See Read your reports.

Tests adjust to each person

Section titled “Tests adjust to each person”

Each person’s tests get a little harder over time, up to the Maximum difficulty you set in Campaigns. When someone clicks a test link, their next tests are easier again.

Send a test any time

Section titled “Send a test any time”

You can send one test to any staff member from the Staff page whenever you like. It’s a good way to try OutPhish on yourself first. See Send a test now.

Next steps

Section titled “Next steps”