Skip to main content

Follow-up campaigns

Updated

Overview

As an administrator, you can now set up both Phishing Simulations and E-Learning courses on your own. The following article will guide you through setting up follow-up campaigns based on the results of previous campaigns. 

Note: Please log in to the Manager to check the duration of your current Phishing Simulation and E-Learning course. You can find campaign data in the upper right corner of the respective Analytics section.

Phishing Simulations

Key metrics

SoSafe Manager phishing analytics dashboard, Core metrics tab, with Click rate, Interaction rate, and Reporting rate cards, a Click rate vs. benchmark chart, and a Click performance analysis panel listing User groups, Psychological tactics, and Templates.

Here you can assess how resilient your organization is to phishing attacks.

  • Click rate: The percentage of users who clicked on a link or element in a phishing email. The primary goal is to reduce this percentage over the long term.
  • Interaction rate: The percentage of users who entered sensitive data on a fake landing page or enabled macros.
  • Reporting rate: The percentage of users who actively reported the email using the phishing report button. A rising reporting rate is often more meaningful than a falling click rate, as it indicates an active “human firewall”.

You can find a detailed breakdown of all Phishing analytics here.

 

Basic Phishing Simulations 

Basic Simulations are designed to establish a stable baseline level of security awareness across your organization. 

Note: Basic simulations are available from the Essential package onwards.

  • Target audience: All employees in the company (the full user list).
  • Focus: Recognizing common phishing indicators (e.g., incorrect sender addresses, generic salutations and urgent calls to action).
  • Frequency: Continuous, randomized distribution throughout the year to minimize habituation.
New phishing simulation wizard on the Goal step, with Ongoing security awareness training selected instead of the recommended Measure your organization's risk level option. The preselection targets all employees in 1 year with 24 templates.

Our recommendation:

  • Duration: Approx. 1 year.
  • Number of templates: 12 to a maximum of 24 for a 1-year campaign.
  • Difficulty: Adjust difficulty level and include templates with simulated login pages based on previous analytics.
  • Other: If the click rate is very low (< 5%), make templates more challenging.

 

Targeted Phishing Simulations

Note: Targeted phishing simulations are available from the Premium package onwards. If the behavior-based simulation is currently enabled and you would prefer targeted simulations instead, please contact us to switch.

Unlike Basic Simulations, Targeted Simulations let you run separate campaigns for specific user groups.

  • Target audience: High-risk departments such as Finance, HR, or IT Administration; also useful for addressing varying knowledge levels across groups.
  • Scenarios: Templates that mimic real work situations (e.g., fake job applications for HR or spoofed invoices for accounting).
  • Goal: Build awareness of sophisticated social engineering attacks.
Same simulation wizard on the Audience step, with Target specific groups selected instead of All users, showing 10 groups and 30 users selected, including groups named Finance and Code_64024, plus an Edit option.

Our recommendation:

  • Run a basic simulation for all users with general templates.
  • Additionally, run targeted simulations for high risk user groups.
  • Duration: Approx. 1 year (align duration across all active campaigns).
  • Number of templates: Users should receive 12–24 templates per year in total across all simulations.
  • Difficulty: Adjust difficulty level and include templates with simulated login pages based on previous per-group analytics.
  • Other: You can also create custom templates using our Template Studio.

Detailed instructions for creating a targeted phishing simulation can be found here.

Behavior-based Simulation

Note: Behavior-based phishing simulations are available from the Premium package onwards. If you would prefer to use targeted simulations rather than behavior-based ones, please let us know, and we will disable this feature.

This simulation adapts dynamically to each user’s behavior.

  • Target audience: All employees in the company (the full user list).
  • Trigger logic: Template difficulty adjusts based on each user's click behavior (users who identify easier templates will receive progressively harder ones).
  • Goal: Keep users engaged by matching challenge level to their current knowledge.
Same wizard's Goal step again, still with Ongoing security awareness training selected, but the preselection now targets all employees starting with 72 templates in a never ending training.

Our recommendation:

  • Duration: Approx. 1 year
  • Number of templates: No fixed minimum — the more templates available, the better the adaptation.
  • You can also create custom templates using our Template Studio.

You can find detailed instructions for creating a behavior-based phishing simulation here.

E-Learning

Key metrics

E-learning progress funnel chart with five stages, Invited, Registered, Started, On track, and Completed, each showing a percentage and user count, dropping from 100 percent invited to 20 percent completed.

This is where progress through training modules is tracked — particularly important for audits and certifications.

  • Learning Progress: How many users are on track, and how many are falling behind? (Key metric: Useful for identifying early whether users are progressing at the right pace).
  • Completion Rate: The percentage of users who have fully completed their assigned mandatory courses. (Most meaningful in the final weeks of the campaign).

You can find a detailed overview of all e-learning analytics here.

 

E-Learning courses for all users

Note: E-learning courses are available from the Essential package onwards. If a course in the course overview displays the message “Older lesson format - cannot be edited” please contact us to have it edited.

  • Target audience: All employees (the full user list).
  • Focus: Interactive knowledge transfer, understanding of security policies, identifying everyday risks, and completing competency assessments for audits.
  • Frequency: Ongoing training throughout the year, with annual refresher sessions and pre-course assessments.
E-Learning Course Management overview listing existing courses with columns for Course name, Timeline, Status, and Actions, and a Create new course button in the top right.

Our recommendation:

  • Duration: Approx. 1 year.
  • Number of modules: varies; typically at least 2–3 modules per month (120 learning minutes per year).
  • Enable pre-course assessments for users who have previously completed cybersecurity training.

Note: Users added after the course starts will automatically receive an invitation. Learning paths (i.e., the modules) are dynamically distributed over the remaining course duration.

E-Learning courses for specific user groups / Concurrent courses

Note: When a single course would not serve all employees equally well, this may lead to frustration, wasted time, and unnecessary module completion. While survey-based modules within a course already provide some personalization, running parallel courses may be the right choice in the following scenarios:

  • Role-specific onboarding (Orientation)
  • Different compliance requirements (Mandatory training)
  • Targeted training for management or leadership

Important: Course assignment is based on user groups. Each user group can only be assigned to one course at a time. Avoid moving users or user groups between courses while they are running — this can distort analytics and may cause users to repeat modules.

The more concurrent courses you run, the greater the administrative burden and the higher the risk of errors for the administrators.

Our recommendation:

  • Duration: Approx. 1 year (same duration for all courses)
  • Number of modules: varies; typically at least 2–3 modules per month of course duration.
  • Keep the number of parallel courses to a minimum to reduce administrative complexity.
  • Enable pre-course assessments for users who have previously completed cybersecurity training.

 

Migration to new SSO 

If you haven't already done so, please switch to our new, improved single sign-on solution based on Auth0. It offers a much better user experience and is more secure as well. If you have admin rights, the migration only takes a few minutes. You can find more information here.

 

Custom modules

Note: Available from the Premium plan onwards.

You can also extend your e-learning course with your own modules. Two options are available:

  • Policy-to-Lesson: Use the AI in Policy-to-Lesson to convert company policies in PDF format into lessons, add a quiz, and activate them in a course just like any other module.
  • SCORM Upload: Upload your own SCORM files and activate them in the course.  

 

Related articles