Automating Phishing Tests and Remedial Training Using Smart Groups

If you’re a Platinum or Diamond-level customer, you can use our Smart Groups feature to automate tiered phishing tests, as well as remedial training, for users who fail your phishing security tests. For general and additional information about Smart Groups, please see the Additional Smart Group Resources section of this article.

This guide offers two automated plans that work together to train your users in a highly efficient manner:

The Dynamic Phishing portion of this article will show you how to set up Smart Groups and phishing campaigns to automate phishing security tests. The plan will dynamically assign more frequent phishing tests to users who have recently failed, and less frequent phishing tests to the users who are passing their tests.

The Automated Remedial Training portion of this article will show you how to set up Smart Groups and remedial training campaigns to automate remedial training. Users are enrolled into a training campaign after each phishing test failure.

When you're ready to set up these plans, as a best practice, we suggest following the outline of this article. Start by creating your dynamic phishing plan's Smart Groups and phishing campaigns, then set up the remedial training plan's Smart Groups and training campaigns.

See the sections below for details on how each plan works, and things you should consider before creating these workflows.

JUMP TO:

Dynamic Phishing Using Smart Groups: How Does It Work?

• Step One: Create Two Smart Groups for Dynamic Phishing
• Step Two: Set Up Two Campaigns for Dynamic Phishing

Automated Remedial Training Using Smart Groups: How Does It Work?

• Before You Begin
• Step One: Create Three Smart Groups for Remedial Training
• Step Two: Set Up Three Campaigns for Remedial Training

Additional Smart Groups Resources

Dynamic Phishing Using Smart Groups: How Does It Work? 

You can use Smart Groups to automate dynamic phishing security tests for your users. The plan is considered dynamic because your users are tested more or less often, as necessary, depending on their performance in phishing campaigns.

See the details below for a description of how this plan works:

1. Users begin in the "Advanced Phishing" Smart Group and, therefore, the "Advanced Phishing" phishing campaign.
   • The "Advanced" phishing campaign tests users on a monthly basis, using the more challenging (3-5 star) phishing templates.
2. Once they fail a phishing test, users are automatically removed from the "Advanced Phishing" Smart Group and added to the "Beginner Phishing" Smart Group.
3. Once users are added to the "Beginner Phishing" Smart Group, they're also added to the "Beginner Phishing" phishing campaign.
   • The "Beginner" phishing campaign tests users every other week, using the less challenging (1-3 star) templates.
4. Once users have passed two consecutive phishing tests, they're automatically re-added to the "Advanced Phishing" Smart Group and, therefore, the "Advanced Phishing" phishing campaign.
   

If you choose to implement an automated remedial training plan alongside this phishing plan, users will be enrolled into remedial training each time they fail a phishing test, regardless of which Smart Groups they're in. See the Automated Remedial Training Using Smart Groups: How Does It Work? portion of this article for more information.

Back to Top

Step One: Create Two Smart Groups for Dynamic Phishing

Follow the steps below to create two Smart Groups for your dynamic phishing plan.

1. From your console, click Users, then click the Groups tab.
2. Click the +New Group button and name your Smart Group. Title the first Smart Group “Beginner Phishing”, and the next “Advanced Phishing” (or use similarly-clarifying titles).
3. Be sure to click the Smart Group checkbox before clicking the Submit button.
   
4. Now, add the Phish Event criteria rule to each of your Smart Groups. Refer to the images below to see the criteria specifications you'll make for the applicable Smart Group.

Beginner Phishing Smart Group

Advanced Phishing Smart Group

5. Be sure to click the Save button to save your Smart Group criteria.

Using the criteria above, your users will only qualify for one of these groups at a time. They will move between Smart Groups appropriately and automatically.

Once you've created your Smart Groups, see the next section to set up the corresponding phishing campaigns.

Back to Top

Step Two: Set up Two Campaigns for Dynamic Phishing

Follow the steps below to complete your dynamic phishing plan set up. You will create two phishing campaigns–one for each Smart Group you've created in the section above.

1. From your console, click the Phishing section.
2. Click the + Create Campaign button.
3. The suggested settings for the "Beginner Phishing" campaign are outlined below. The campaign settings that are not outlined below can be made at your discretion. See our How to Create a Phishing Campaign article for general recommendations.
   
   

   Beginner Phishing Campaign

   
   • Name: Give the campaign a descriptive name such as “Beginner Phishing”.
   • Deliver to: Select your “Beginner Phishing” Smart Group from the drop-down menu.
   • Frequency: Select Bi-Weekly or an alternative frequency that corresponds with your "Beginner Phishing" Smart Group criteria.
   • Start Time: Be sure to start your campaigns on the same date. This includes both of your phishing campaigns, as well as the training campaigns you'll set up in the remedial training portion of this article.
   • Categories: As a best practice, select template categories that are not typically connected with an employee’s email address (i.e., Banking, Social Networking, etc.).
   • Difficulty Rating: Select the one, two, and three-star difficulty ratings.
4. Click the Create Campaign button to save your "Beginner Phishing" campaign.
5. Repeat steps one and two above, then see below for the suggested settings for the "Advanced Phishing" campaign. The campaign settings that are not outlined below can be made at your discretion. See our How to Create a Phishing Campaign article for general recommendations.
   
   

   Advanced Phishing Campaign

   
   • Name: Give the campaign a descriptive name such as “Advanced Phishing”.
   • Deliver to: Select your “Advanced Phishing” Smart Group from the drop-down menu.
   • Frequency: Select Monthly or an alternative frequency that corresponds with your "Advanced Phishing" Smart Group criteria.
   • Start Time: Be sure to start your campaigns on the same date. This includes both of your phishing campaigns, as well as the training campaigns you'll set up in the remedial training portion of this article.
   • Categories: As a best practice, select template categories that are typically connected with an employee’s email address (i.e., Human Resources, IT, Mail Notifications, etc.).
   • Difficulty Rating: Select the three, four, and five-star difficulty ratings.

After creating your campaigns, users should begin in the "Advanced Phishing" Smart Group. They will begin receiving phishing tests once your phishing campaigns have started.

Proceed to the following sections if you'd like to automate a remedial training plan designed to work with this dynamic phishing plan. 

Back to Top

Automated Remedial Training Using Smart Groups: How Does It Work?

The automated remedial training plan found in this article was designed to work alongside the dynamic phishing plan outlined in the sections above.

Once you've set up the training and phishing plans included in this article:

• Users are automatically enrolled in remedial training each time they fail a phishing test.
• The number of phishing test failures users have recently had determines which "round" of remedial training they are assigned.
• Users are given "new" remedial training assignments after their first three failures. Should users fail a fourth test, they're re-enrolled into the first "round" of remedial training, then the second, and third "rounds" of remedial training, when applicable.

Using this plan, users will be enrolled in a new remedial training campaign upon their first three phishing security test failures. Refer to the following two sections to create an automated flow of remedial training events should users fail your phishing security tests under your dynamic phishing plan.
If you're looking for general instructions for creating Smart Groups, please see our How to Use Smart Groups article.

Back to Top

Before You Begin

Address the following before setting up this automated remedial training plan:

1. Have you set up the dynamic phishing plan found in this article?
   • We suggest setting up this remedial training plan alongside the dynamic phishing plan outlined above. If you'd like to see an alternative automated remedial training plan, please see this article: Automation with Smart Groups: Remedial Training.
2. How often can you phish your users?
   • Considering this plan was designed to work alongside the dynamic phishing plan outlined above, it assumes users are tested on a monthly and bi-monthly basis. If you are using a different phishing schedule, the Smart Group rules outlined in the following section will need to be adjusted accordingly.
3. Determine what training content you want to use for your remedial training campaigns.
• Browse the ModStore and determine which modules, videos, or games you'd like to assign for each round of remedial training before creating your Smart Groups.
4. Once you've set up this plan, it will run indefinitely.
   • Consider how long you'd like to let the plan run before updating the training content you're assigning. For example, you could set a reminder to re-create this plan at the same time next year.

Follow the next two sections to create your automated remedial training plan.

Back to Top

Step One: Create Three Smart Groups for Remedial Training

Follow the steps below to create three Smart Groups for your remedial training plan:

1. From your console, click Users. Then, click the Groups tab.
2. Click the +New Group button and name your Smart Group. Title the Smart Groups something descriptive of their purpose. For instance, “Remedial Training - Round 1”, “Remedial Training - Round 2”, etc.
3. Be sure to click the Smart Group checkbox before clicking the Submit button (as shown below).
   
4. Now, add the criteria rules outlined below to the appropriate "Remedial Training" Smart Group.

Remedial Training - Round 1

This criteria set includes users who have failed one phishing test in the last 4 weeks. These users will be automatically enrolled into your "Remedial Training - Round 1" training campaign (see the next section for details).

5. Now, set up a second Smart Group for the users who have had another failure after completing the first round of remedial training. Follow steps 1-3 (above) to name your Smart Group, then add the criteria rules shown below.

Remedial Training - Round 2

This criteria set includes users who have failed phishing tests two times in the last 4 weeks, have completed the "Round 1" remedial training, and have not completed the "Round 2" remedial training.

6. Now, set up a second Smart Group for the users who have had another failure after completing the second round of remedial training. Follow steps 1-3 (above) to name your Smart Group, then add the criteria rules shown below.

Remedial Training - Round 3

This criteria set includes users who have demonstrated failures exactly three times in the last 4 weeks, have completed the "Round 2" remedial training, and have not completed the "Round 3" remedial training.

Proceed to the next section to create remedial training campaigns.

Back to Top

Step Two: Set Up Three Campaigns for Remedial Training

Follow the steps below to complete your remedial training plan set up. You will create three training campaigns–one for each Smart Group you've created in the section above.

1. In your console, click the Training section.
2. Click the + Create Training Campaign button.
3. The suggested settings for these remedial training campaigns are outlined below. The campaign settings that are not outlined below can be made at your discretion.
   
   1. Campaign Name - Give the campaign a descriptive name such as “Remedial Training – Round 1”.
   2. Start Date - It is important to start the remedial training campaigns on the same date as your dynamic phishing campaigns.
   3. End Date - Be sure to choose a Relative Duration end date so the campaign is ongoing. Select a relative duration of 2 Weeks or less to stay aligned with the dynamic phishing plan.
   4. Content - The training content must match the selection you made in the associated Smart Group Training criteria rule.
   5. Enroll Groups - Be sure to select the appropriate Smart Group for the round of remedial training you are creating (i.e., “Remedial Training – Round 1”).
   6. Enable automatic enrollment for new users - It is important to keep this option enabled. This allows automatic training enrollment as a result of being added to a Smart Group after failing a phishing test.
   7. Enable progress reset for remedial training - Enabling this option will reset a user’s progress if they are re-enrolled in this campaign.
   8. Notifications - At a minimum, you’ll want to add a Welcome notification here to notify your users upon their enrollment in remedial training. We would also recommend adding one to two reminder notifications to encourage the user to complete the training prior to their due date.
      For your Welcome notification, we recommend that you use a template which indicates that the user failed a phishing test to let them know why they've been enrolled in this particular training campaign. We have a sample template in the system ("Oops, you failed a phishing test") that you can make edits to if you'd like by clicking the Manage Notification Email Templates link. For more on training notifications, click here.
4. Click the Create Campaign button to save your campaign.
5. Repeat steps 1-4 to create your "Remedial Training - Round 2" and "Remedial Training - Round 3" training campaigns.

Back to Top

Additional Smart Group Resources

See the following resources to learn more about what you can do with Smart Groups:

How to Use Smart Groups
How to Use Smart Groups: Use Cases
How to Use Smart Groups: Automated Remedial Training
Video: Introduction to Smart Groups
Video: How to Rollout Periodic Training Using Smart Groups

Back to Top