Phishing simulations let you send test phishing emails to your users to measure how many click links or submit credentials, without any real attacker involvement. Cypher tracks opens, clicks, and submissions as the campaign runs. Anyone who clicks a link or submits credentials is automatically enrolled in a remediation micro-lesson. Simulations are available on both Essentials and Complete tiers.
Cypher also supports vishing (voice call) simulations using AI-generated caller scripts, which follow a similar setup flow.
Creating a Phishing Campaign
- Go to Phishing in the Cypher navigation.
- Click New Campaign.
- Select your audience: the whole company, a specific role, or individual users.
- Choose a template (see below).
- Set the send window — the date range during which the simulated emails will go out.
- Click Launch.
Choosing a Template
You have two options:
Use a library template — Select from the existing template library. Templates are categorised by theme (package delivery, IT helpdesk, HR notice, and so on).
Generate a new template with THEO — Click Generate and enter a theme, such as "package delivery notice" or "IT security alert." THEO produces:
- A subject line
- An email body
- A sender persona
- A list of red flags embedded in the email (used for training after a click)
Review the generated template before launching. You can edit any field before saving it to the library or using it one-time.
You can also paste your own custom template into the template editor if you have an existing template you want to use.
Tracking Results
Once a campaign is live, the campaign status page shows real-time delivery events:
- Sent — email delivered to the inbox
- Opened — recipient opened the email
- Clicked — recipient clicked a link in the email
- Submitted — recipient entered credentials on the simulated landing page
These metrics update as the campaign runs. Use them to identify which users or roles are most susceptible.
Automatic Remediation Enrollment
When a user clicks a link or submits credentials in a phishing simulation, Cypher automatically assigns them a micro-training lesson. The lesson is matched to the type of lapse — link click, credential submission, or attachment open.
The assignment appears on the user's dashboard within minutes of the click event. The user also receives a reminder email with a direct link.
Note: There is a 24-hour per-user per-trigger cooldown. If a user clicks multiple links in the same day, only one micro-training assignment is created in that window.
Reviewing Campaign History
Previous campaigns remain accessible in the Phishing section. Click any past campaign to review its final metrics. Use this data to track improvement over time — compare click rates across campaigns to see whether training is having an effect.
FAQ
Will users know the phishing email was a test? Not until they click a link or submit credentials. At that point, they see a notice explaining that this was a simulated phishing test and that they have been enrolled in a brief training session.
Can I reuse a THEO-generated template in a future campaign? Yes. Templates generated by THEO can be saved to the library and selected again in future campaigns.
What if the phishing email never arrives? Confirm the recipient address is correct in the campaign settings. Check that your domain's email configuration allows send-to-self for simulation purposes. The campaign status page shows delivery events — if there are none, the send may be blocked at the mail server level.
Related
- Training Modules
- Reports
- Completing Training