How to Set Up Remedial Training 

Using Groups in the console, you can target those users who need security awareness training the most: your phish-prone users.

A phish-prone user is someone who has failed your phishing test, whether by clicking a phishing link, opening an attachment, entering data on a landing page, or conducting other potentially dangerous behavior. See: How Is Phish-Prone Percentage Calculated?

This guide will show you how to automatically group phish-prone users and assign them to a training campaign. Once the below steps are followed, you'll have a completely automated ongoing phishing and remedial training campaign system set up. If you'd like to watch a video of the below instructions, check out our Remedial Training Campaigns tutorial.

Jump to:

Step One: Create a Remedial Training Group
Step Two: Create a Remedial Training Campaign
Step Three: Create a Phishing Campaign
End Result

Step One: Create a Remedial Training Group

The first step is to create a group for your phish-prone users. You'll enroll this group in your remedial training campaign, as detailed in Step Two. Create the group from the Groups tab beneath the Users area of your console. You can name the group “Phish-Prone Users”, “Clickers”, “Remedial Training” or whatever you’d like.

See: How do I create a new group?

Alternatively, you can use our Smart Groups feature (Platinum/Diamond only) to create a group of users based on a specified number of phishing test failures. To learn more about Smart Groups, review our product manual. You can also watch our Remedial Training Using Smart Groups video.

Step Two: Create a Remedial Training Campaign

For your remedial training campaign, choose the settings outlined below:

Example of a Remedial Training Campaign

1) End Date We recommend choosing a relative enrollment duration of two to four weeks, meaning each user will have that amount of time to take the training upon their enrollment. Having a deadline gives users an incentive to complete the training. If users miss their training deadlines, see: How to Modify Training Deadlines.

2) Content Choose what course(s) you'll want to enroll users in. We recommend using one of our fifteen-minute courses or micro-modules for remedial training purposes.
(You also have the ability to assign your organization's policies through your training campaigns, see here for more info.)

3) EnrollGroups Enroll your phish-prone users in your Remedial Training course by selecting the group you set up in Step One, here.

4) Automatically enroll users that are added to the above groups in the future Leave this checkbox on. This will ensure new additions to your "Clickers" group are assigned the training.

5) Enable courses to be done multiple times Check this box if you want to ensure that phish-prone users can be enrolled in this course multiple times if they continue to fail your phishing tests. This function should only be used for remedial training purposes.
With this setting, the next setting (#6) is also vital, to ensure that phish-prone users can be re-added to the Clickers group and thus re-enrolled in remedial training.
It works as follows: A user completes their remedial training and is removed from the "Clickers" group. Then, they fail another phishing test, are re-added to the "Clickers" group and thus re-enrolled in the remedial training campaign. Their previous completion data will be saved to the user profile and training reports.

6) Remove Completed Users From  If you want phish-prone users to be re-added to Clickers and thus re-enrolled in remedial training if they fail your phishing test again, be sure to select your "Clickers" group here. This means that when they complete the assigned remedial training, they'll be automatically removed from the "Clickers" group, and can be added back should they fail a future phishing test.

7) Notifications  At a minimum, you’ll want to add a Welcome notification here to notify your users upon their enrollment in remedial training. We would also recommend adding one to two reminder notifications to encourage the user to complete the training prior to their due date.

For your welcome email, we recommend using a template indicating that the user failed a phishing test to let them know why they've been enrolled in this particular training campaign. We have a System Template you can use for this purpose, it's titled: "Oops, you failed a phishing test". You can make edits to this template if you'd like by clicking the Manage Notification Email Templates link at the bottom of the Create Training Notification widget.

Back to Top

Step Three: Create a Phishing Campaign

Create a phishing campaign. When users fail a phishing test from this campaign they will be automatically enrolled in your remedial training campaign. This campaign can target all of your users or specific groups. This can be a one-time test or an ongoing series of phishing tests.
When setting up this campaign, take note of the Add Clickers To option: Be sure to select the same group you created in Step One from the drop-down menu, as shown below.

Example of a Remedial Phishing Campaign

When this phishing campaign runs, any users who fail the tests will automatically be added to the group you've selected for Add Clickers To.

Once users are added to the "Clickers" group, they are also automatically enrolled in the remedial training campaign you created in Step Two.
Upon enrollment, users will receive the welcome notification you've scheduled for the campaign, which will include a link to take the training.

Back to Top

End Result

The goal is to train your phish-prone users as soon as possible after they fail a phishing test. Using the steps above results in a scenario where users can receive almost immediate feedback when they fail the phishing tests you send them. They will be automatically enrolled in the training module you've selected and, within minutes, they'll receive an email inviting them to take the required training so they can sign in and begin right away.

Back to Top