Staff training

Every staff member is asked to complete a short online course about recognising and reporting phishing. OutPhish emails them a link, reminds them until they’ve finished, and shows you who has finished on the Reports page.

When staff are asked to do the training

• When you add them. Someone you add with Add staff gets a welcome email with a Start Your Training button. Staff added with Import CSV don’t get this email. They get the monthly reminder instead, or you can send them a reminder yourself (see below).
• After they fail a test. About a minute after someone clicks a test link or enters details, they get an email with the subject “Phishing Test Feedback”. It shows the test email, points out the clues they could have spotted, and has a Complete Your Training button. Their training is marked as not finished, even if they’d finished it before. Just opening a test email doesn’t reset their training. See What staff see.
• Once a year, if you choose. This depends on the Training frequency setting (see below).

Choose how often training is needed

1. Go to Campaigns.
2. Under Schedule, choose a Training frequency:
   • Annually and On Fail: training also runs out a year after someone last finished it. They then get an email headed “Your annual training is due”.
   • On Fail Only: training is only reset when someone fails a test.
3. Click Save changes.

Is the training compulsory?

OutPhish treats it as required. Unfinished training shows as Pending in your reports, counts towards Employees needing attention (with On Fail Only, only after a failed test), and triggers a reminder every month until it’s done. OutPhish can’t make anyone do it, though, and nothing is locked or blocked if they don’t.

What the course covers

The course is called “Recognise and stop phishing” and takes about 25–35 minutes. No previous security knowledge is needed. It has five lessons, each ending with a knowledge check:

1. How phishing works
2. Spot the warning signs
3. Real-world scenarios
4. Report and respond
5. Keep the habit

How it works for staff:

• Before starting, they tick I agree to the Terms of Use and click Accept and start.
• Lessons open in order. Each one unlocks when they pass the previous knowledge check.
• Each knowledge check has four activities, such as choosing answers, matching, putting steps in order and spotting warning signs in an example message. All four must be right to pass. They can try again as often as they need.
• Course region switches the examples and support resources between Australia, the United Kingdom and the United States. It normally starts on the region that matches your organisation’s time zone.
• Glossary explains the terms used in the course.

Note

Progress is saved in the browser. If someone closes or reloads the page, they carry on where they left off when they open the same link again in the same browser. Saved progress lasts about 8 hours from the last knowledge check they passed. After that, or on another device or browser, they start again from the first lesson.

If an IT provider runs OutPhish for you, the course shows the provider’s name.

Personal training links

Every welcome, feedback and reminder email contains a link that’s personal to that staff member. When they finish the course from that link, OutPhish records it against them automatically.

• Links expire after 14 days. An expired link shows “This training link has expired. Please contact your administrator if you need a new one.” Send them a reminder to give them a fresh link.
• Links are tied to one person. If someone forwards their link, whoever finishes the course from it is recorded as the person it was sent to.
• Without a personal link, the course page says “This course is not linked to an employee record.” They can still do the course, but it isn’t recorded in OutPhish. If that happens, you can mark their training as complete.

Reminders

• Every month: on the 1st of each month, everyone whose training isn’t finished gets a reminder email with a fresh link and a Complete Your Training button. Anyone already reminded in the last day is skipped. On the same day, your Organization Admins get a report listing who still hasn’t finished. See Download and email reports.
• Annual renewal: with Annually and On Fail, OutPhish checks every day and sends a renewal email when a year has passed since someone last finished.

Send a reminder yourself

1. Go to Staff.
2. Do one of these:
   • For one person, click the Send training reminder button (the graduation cap) in their row.
   • For everyone who hasn’t finished, click Send training reminders at the top of the page, then confirm. Anyone already reminded in the last day is skipped.

The graduation cap button only appears for staff who haven’t finished. Sending reminders needs permission to send tests, which the Organization Admin and Campaign Manager roles have.

Certificates

When a staff member finishes the course from their personal link, OutPhish emails them a certificate. It shows their name, your organisation, the date, which completion it is (for example, Completion #2) and when their next training is due. With On Fail Only, there’s no date. It says training is due again only if they fail a test. Every certificate reminds them they’ll need to retrain if they fail a test.

The certificate goes to the staff member only. Admins don’t get a copy, so check the Reports page instead.

Certificates without a personal link

Someone who does the course without a personal link can ask for a certificate at the end, under Email my completion certificate:

1. They enter their organisation, their name and email, and their supervisor’s name and email.
2. They tick the boxes to agree, then click Verify email and request certificates.
3. OutPhish emails them a link to confirm their email address. The link expires after 24 hours.
4. Once they click Verify email and send certificates in that email, OutPhish sends a certificate to them and a separate copy to their supervisor. Each certificate has a reference number.

This doesn’t update your reports.

Checking a certificate

OutPhish doesn’t have a page for looking up certificates. The Reports page is your record of who has finished. For certificates requested without a personal link, OutPhish confirms the learner’s email address before sending anything, and the supervisor gets their copy directly from OutPhish.

See who has finished

• Reports: in the Employee details table, the Training column shows Done or Pending. Click a row to see the date it was Last completed. See Read your reports.
• Employees needing attention on the Reports page shows Training incomplete for anyone whose training is due but not finished. With On Fail Only, that’s only after a failed test.
• Home: Recent activity shows when someone completed training.
• Staff: people who have finished show a greyed-out graduation cap instead of the Send training reminder button.
• The monthly training report emailed to Organization Admins on the 1st.

Mark training as complete

Use this if someone finished the course but it wasn’t recorded. For example, their link failed, they did it without their personal link, or the course told them “The course is complete, but the completion record could not be saved.”

1. Go to Staff.
2. In their row, click Mark training as complete (the tick button).
3. Confirm.

No certificate is sent when you do this. You need permission to edit staff, which the Organization Admin role has.