Add and manage staff

Your staff list is everyone OutPhish sends practice phishing emails and training to. You manage it on the Staff page in the menu.

You need the Organization Admin role (or a custom role that allows it) to add, edit or archive staff. People with the Campaign Manager or Report Viewer role can see the list but can’t change it. See Users and roles.

Note

If you’re an IT provider, open the client first. The Staff page then shows that client’s staff. See Add and manage clients.

What you can enter for each person

Field	Required?	Notes
First name	Yes	2 to 20 characters
Last name	Yes	2 to 20 characters
Email	Yes	Their work email address
Role	No	Their job title, for example “Practice Manager”. Up to 50 characters.

It’s worth filling in Role. As a person’s difficulty level rises, tests that OutPhish writes with AI can mention their role, and the names and roles of their colleagues. This makes the tests more realistic.

Each email address can only be on one staff list in OutPhish. If the address is already in use, even by another organisation, OutPhish won’t add it again. Capital letters don’t matter. OutPhish saves addresses in lower case, so [email protected] and [email protected] are the same address.

Add staff one at a time

1. Go to Staff.
2. Click Add staff.
3. Fill in First name, Last name, Email and, if you like, Role.
4. Click Add.

OutPhish emails the new staff member a welcome message straight away. It’s called “Welcome to OutPhish”. It tells them to expect simulated phishing emails and has a Start Your Training button. If you’re an IT provider, the email shows your business’s name instead of OutPhish.

Tip

Because the welcome email goes out as soon as you click Add, you may want to tell your team about OutPhish first.

If the email address belongs to someone you’ve archived, OutPhish tells you to restore them from the Archived tab instead. See Restore an archived staff member.

Import many staff from a CSV file

A CSV file is a plain spreadsheet file. You can save one from Excel, Google Sheets or Numbers.

1. Go to Staff.
2. Click Import CSV.
3. Click Download template. This gives you a file with the right column headings and two example rows.
4. Open the template and replace the example rows with your staff, one person per row.
5. Save it as a CSV file.
6. Back on the Staff page, choose your file under CSV file, then click Import.

The file needs these column headings in the first row:

Column	Required?
first_name	Yes
last_name	Yes
email	Yes
role	No

The columns can be in any order, and capital letters in the headings don’t matter. OutPhish ignores any other columns.

When the import finishes, OutPhish shows how many staff were added, how many duplicates were skipped and how many rows had errors. It lists the first five errors by row number.

• Rows with a name shorter than 2 or longer than 20 characters, a role longer than 50 characters, or an invalid email address, are skipped.
• Rows with an email address that’s already in OutPhish are skipped as duplicates. If the address belongs to someone you’ve archived, OutPhish tells you to restore them instead.
• If you reach the number of staff your plan covers, the import stops there. The rest of the file isn’t imported. See Staff and your plan.

Note

Staff you import get the same welcome email as staff added one at a time. It goes out a few moments after the import finishes, so tell your team about OutPhish before you import them.

If the import doesn’t work

• “Please select a valid CSV file.” Check that you chose a file and that its name ends in .csv.

Read the staff list

The Active tab shows current staff. The Archived tab shows people you’ve archived. The number next to each tab is how many people are on it.

The list has these columns:

• Name, Email and Role.
• Difficulty: how convincing this person’s tests are. It starts at 0 and goes up as they’re tested, until it reaches the Maximum difficulty set on the Campaigns page. It drops if they click a link in a test, and goes back to 0 if they enter their details. See How tests work.
• Next email: the date and time of their next scheduled test, in your organisation’s timezone. It shows Not scheduled if they don’t have one yet.

The top of the page shows how many active staff you have and, if your plan has a limit, what it is.

Edit a staff member

1. Go to Staff.
2. On the person’s row, click the pencil (Edit) button.
3. Change their details.
4. Click Save changes.

You can change someone’s email address, as long as no other staff member in OutPhish already uses it.

Archive staff who leave

Archive people when they leave, so they stop getting tests and stop counting towards your plan. Their history is kept.

1. Go to Staff.
2. On the person’s row, click the Archive button (the box icon).
3. Click OK to confirm.

Archiving cancels their next test and stops future tests. They move to the Archived tab. While they’re archived, they don’t appear on the Reports page.

There’s no way to delete a staff member. Archiving is how you remove someone from your list.

Restore an archived staff member

1. Go to Staff.
2. Click the Archived tab.
3. On the person’s row, click the Restore button (the curved arrow).

They move back to the Active tab. If scheduled tests are switched on, they’re included the next time tests are scheduled.

You can’t restore someone if you’re already at the number of staff your plan covers. Archive someone else first, or increase your plan. See Staff and your plan.

Other buttons on the Staff page

Depending on your role, you may also see these buttons on each row:

• Send test email (envelope icon) and Send test with options (sliders icon): send this person a test now. See Send a test now.
• Send training reminder (mortarboard icon): email this person a reminder to finish their training.
• Mark training as complete (tick icon): only for when someone finished their training but it wasn’t recorded, for example because their link failed. No certificate is sent.

At the top of the page, Send training reminders emails everyone who hasn’t finished their training. Anyone already reminded in the last day is skipped. See Staff training.