In this article, you will learn how to remove failures from your users’ phishing test results.

The following types of phishing failures can be removed:

• Clicks
• Attachment opens
• Replies
• Reply content
• Macros enabled
• Data entry
• QR code scans
• Calling the number and entering the callback code in a callback phishing email
• Entering personal information in a callback phishing call
  Important: We don't record any data that your users enter in a callback phishing call.

Removing failures cannot be reversed. After a failure is removed, your KSAT account may take up to 15 minutes to update your reports.

Email opens are not considered a failure on a phishing test and do not contribute to a user's Phish-prone Percentage.

There are two methods you can use to remove phishing test failures. You can either remove failures from the phishing campaign's report or from the affected user's timeline.

Remove a Failure from the Phishing Campaign Report

You can remove phishing test failures from a phishing campaign report individually or in bulk.

1. Log in to your KSAT account and navigate to Phishing > Campaigns. 
2. From the list of phishing campaigns, click the campaign that you would like to remove a failure from.
3. Select the Users subtab.
4. Click on the column header for the type of failure you want to remove. For example, if you would like to remove a QR code failure from a phishing test, click the QR Code Scanned column.
5. Once you've clicked the column header, you can remove a failure for a single user or remove failures for multiple users.
   • To remove failures for multiple users at once, click Bulk Update. You will be asked to upload a CSV file that lists those specific users. The CSV file must contain the Email and Update-Value headers. You have the option to send a notification to console administrators once the bulk failure removal is complete. Once you have selected your CSV file and configured your notification settings, click Bulk Update. Removing a phishing failure is not reversible. You will be prompted with a deletion confirmation before the failure is removed.
   • To remove a failure for one user, find the user's name in the user list and click the trash can icon to the right of their name.
     Note: For reply-to phishing failures, you can delete the content of the user's reply without deleting the failure. To delete the content of the reply click the red arrow to view the reply content, then click Delete Reply Content.
      
6. When prompted to confirm your action, click either Confirm or Cancel. Remember that removing a failure cannot be reversed.After you click Confirm, the failure is removed. All failure removals will be recorded on the associated user profiles within the user's timeline.

Back to top

Remove a Failure from a User's Timeline

You can remove phishing test failures from an individual user's timeline. To use this method, follow the steps below:

1. Log in to your KSAT account and navigate to the Users tab. 
2. Select the Users subtab.
3. From the list on the Users subtab, find the affected user. 
4. Click the user's name or email address to go to their User Profile.
5. Click on their User Timeline tab. 
6. Find the phishing failure you would like to remove.
   Important:We recommend using the Event Type or Date Range drop-down menus to quickly find the event you are looking for.
7. Once you have found the failure you want to remove, click the trash can icon next to the failure.
8. When prompted to confirm your action, click either Confirm or Cancel. Remember that removing a failure cannot be reversed.After you click Confirm, the failure is removed and the removal is recorded on the user's timeline.

Back to top