Read your reports

The Reports page shows how your staff have handled the simulated phishing tests. Open it from Reports in the menu, or click View reports on the Home page.

Anyone with the Organization Admin, Campaign Manager or Report Viewer role can open it. See Users and roles.

IT providers

Switch to the client first, then open Reports. The page shows that client’s results. See Add and manage clients.

What period the page covers

The whole page covers this month so far plus the 11 months before it. You can’t choose a different period.

Months on the charts are shown like 11/26. The current month is marked (MTD), short for “month to date”. Months and dates follow your organisation’s time zone.

Staff you’ve archived are left out of the page. They’re also left out of downloads and report emails.

How OutPhish knows what someone did

Each test sent to one person is counted once, at the furthest step they reached:

Result	What it means	How OutPhish knows
Compromised	They typed into the fake sign-in page and pressed its sign-in button.	The fake page tells OutPhish the button was pressed. What they typed is never sent to OutPhish.
Clicked	They followed the test link but didn’t go on to sign in.	The fake sign-in page loaded. Scanning the test’s QR code or opening the link in its PDF counts too.
Opened	They opened the email but didn’t follow the link.	A tiny invisible picture in the email loaded.
Not interacted	Nothing was recorded.

Keep these limits in mind:

• Opens are a rough guide. If someone’s email program blocks pictures, their open isn’t recorded. Some email programs and security filters load pictures by themselves, which can record an open the person didn’t make.
• Automatic clicks are ignored. A click within 6 seconds of the email being sent isn’t counted, because that’s usually an email security filter checking the link, not a person. Sign-ins made within 3 seconds of the page loading, or with no mouse or keyboard activity, are ignored too.
• Test links stop working after 14 days. Clicks after that aren’t counted.

The Reports page doesn’t show whether staff reported a test email to you.

Organisation overview

The five figures at the top cover every test in the period:

• Exposed exercises: the number of tests sent to staff. One test to one person counts once. The note underneath shows how many emails were sent, which is normally the same number.
• Opened, Clicked only, Compromised and Not interacted: how many of those tests ended at each step. These four add up to Exposed exercises.

Tip

Clicked only doesn’t include people who went on to enter details. They’re counted in Compromised. To find everyone who clicked, add the two together.

The charts

Interaction breakdown

A pie chart of the same four results. In its key, Links Clicked means the same as Clicked only, and Credentials Compromised means the same as Compromised.

Monthly trend

For each month, how many tests were sent and how they ended, stacked in layers: Compromised, Clicked Only, Opened Only and Not Interacted. Each test is counted in the month it was sent. Hover over a month to see the numbers and the total.

Thin upright lines mark the moments people clicked (dashed lines) or entered details (solid lines).

Click and compromise rate

For each month, the percentage of that month’s tests that ended in a click (% Clicked) or in entered details (% Compromised). As above, % Clicked leaves out people who went on to enter details. A month with no tests shows 0%.

Employees needing attention

This list ranks staff who may need follow-up. It looks at tests sent in the last 3 months and at whether training that’s due is finished. Each person gets points:

	Points
Each test where they entered details	15
Each test where they clicked but didn’t enter details	10
Each test they only opened	0.25
Training due but not finished	10

The badge shows their total: Critical risk for 20 or more, High risk for 10 or more, Medium risk for 5 or more, and Low risk below 5.

Everyone at High or Critical risk is listed. If fewer than 5 people are, the list is topped up to 5 with the next-highest scores. Under each name you’ll see why they’re there: Submitted credentials, Clicked link or Opened (with how many times), and Training incomplete.

Note

Training only counts when it’s due under your Training frequency setting:

• Annually and On Fail: everyone’s first training is due straight away. Unfinished training alone puts someone at High risk, so new staff show as High risk until they finish their first training, even before their first test.
• On Fail Only: unfinished training only counts after someone fails a test. New staff who haven’t failed one don’t get these points.

See Staff training.

Employee details

A table with a row for each current staff member. Type a name in Filter employees to find someone. Click a column heading to sort by it.

• Sent: tests sent to them in the period.
• Opened, Clicked, Compromised: how many of their tests ended at that step, with the percentage of their tests in brackets.
• Trend: compares their last three tests with the three before. Improving means their recent results are better and Declining means worse. Stable means little change, or they’ve had fewer than four tests.
• Training: Done or Pending. Hover over Done to see when they finished.
• Last fail: the date the most recent test they clicked or entered details on was sent. It shows N/A if there isn’t one.

Click a row to see more about that person:

• Recent tests: their latest tests (up to 20), with the date sent, the subject and the result: Ignored (nothing recorded), Opened, Clicked or Compromised. The first 5 show. To see the rest, click the button under the list (for example, Show 4 more).
• Training: their Status, the date it was Last completed (or Never), and their Difficulty level. Difficulty is how convincing their tests currently are, out of 20. See How tests work.

Figures on the Home page

The Home page has a few quick figures. They’re worked out a little differently from the Reports page:

• Tests sent: test emails sent so far this month.
• Click rate: the percentage of tests sent in the last 30 days that someone clicked. Unlike Clicked only on the Reports page, this includes people who went on to enter details. It shows “Awaiting data” if no tests went out in the last 30 days.
• Recent activity: the latest five events, such as a test sent, an email opened, a link clicked, credentials submitted, staff added or training completed. Click View all to open Reports.

To download these results or have them emailed, see Download and email reports.