Removing Failures from Phishing Test Results

The below instructions will explain how to remove failures from your phishing tests. Removing failures cannot be reversed. After removing a failure, it may take up to 15 minutes to update your reports. 

What types of phishing test failures can be removed?

• Clicks
• Attachment opens
• Replies
• Reply Content
• Macros enabled
• Data entry
• Exploits (via EZXploit)

Email opens are not considered a failure on a phishing test and do not contribute to a user's Phish-prone percentage.

Need to remove a phishing test failure from your phishing test results? There are two ways to do this:

Method #1 - From the Phishing Campaign Report

1. Log in to your KnowBe4 admin account.
2. Click the PHISHING tab. 
3. From the Campaigns tab, you will see a list of your phishing campaigns. Click the name of the Campaign where you'd like to remove failures.
   
4. Click the Users tab beneath that Phishing Campaign to view all data associated with the campaign.
   
5. Click on the column header for the type of failure you'd like to remove (Clicked, Replied, Attachment Open, etc.).
   
6. When the list of users who failed appears, you will see a "trash" icon to the right of their name. Click the "trash" icon to remove that failure.
   Note: For "Replied" failures, to delete the content of the user's reply without deleting the Replied failure, click the red arrow to view the reply content, then click "Delete This Reply". 
   
7. You will be prompted to confirm your action, as removing failures cannot be reversed once completed.
   
8. Once confirmed, the failure will be removed. All failure removals will be recorded on the associated user profiles, within the user's timeline.
   

Method #2 - From the Affected User's Timeline on Their Profile Page 

1. Log in to your KnowBe4 admin account.
2. Click the USERS tab. 
   
3. Click the Users tab.
   
4. Click the username or the email address of the affected user.
   
5. Scroll down to the user's timeline and find the failure you'd like to remove. Failures are indicated by a "trash" icon on the user's timeline event. 
   
6. Click the "trash" icon to remove that failure. You will be prompted to confirm your action, as removing failures cannot be reversed once completed.
   
7. Once confirmed, the failure will be removed and the removal will be recorded on the user's timeline.