GoPhish Cloud

Campaign Management

Create unlimited phishing campaigns with scheduling, send windows, and automated lifecycle management. Clone successful campaigns and track historical trends.

Email Templates

Design realistic phishing emails with dynamic personalization, file attachments, and automatic tracking pixels. Import from real-world threats.

Landing Pages

Clone any website or build custom landing pages. Capture credentials safely, track interactions, and redirect to security awareness training.

Real-Time Analytics

Track opens, clicks, submissions, and reports in real-time. Individual user timelines, aggregate statistics, and exportable compliance reports.

Multi-User Collaboration

Role-based access control (Admin/User/Read-Only). Multiple security team members can manage campaigns simultaneously with audit logging.

REST API & Webhooks

Complete API coverage for automation. Real-time webhooks for SIEM integration, ticketing systems, and custom workflows.

Post-Click Training Modules

When an employee clicks a simulated phishing link, they see a brief interactive quiz instead of a dead-end warning page. Quiz scores and completion data are automatically recorded in campaign results — turning every simulated attack into a documented training event.

Campaign Planning

• Start Simple: Begin with obvious emails, gradually increase difficulty.
• Quarterly Cadence: Run campaigns every 3 months for optimal awareness.
• Department Targeting: Focus on high-risk teams (finance, HR, IT) first.
• Timing Matters: Send during business hours (9am-3pm) for realism.
• Progressive Difficulty: Move from generic to spear phishing over time.

Email Template Design

• Use Real Threats: Model templates after actual campaigns in your industry.
• Avoid Obvious Red Flags: Skip poor grammar in early campaigns.
• Brand Familiarity: Impersonate services employees use (Microsoft, Slack).
• Urgency Tactics: Include realistic time pressure (password expiration).
• Test First: Send test campaigns to security team before rollout.

Post-Campaign Actions

• Immediate Education: Display training content, not just warnings.
• Individual Follow-up: Provide personalized training for repeat clickers.
• Positive Reinforcement: Recognize employees who report suspicious emails.
• Metrics Tracking: Monitor click, submission, and reporting rates.
• Executive Reporting: Share anonymized results quarterly with leadership.

Compliance & Ethics

• Transparent Program: Announce simulations will occur throughout the year.
• No Punishment: Focus on training, not disciplinary action.
• Data Privacy: Store results securely, limit access to security team.
• Accessibility: Ensure landing pages are WCAG compliant.
• Legal Review: Have HR and legal review approach before launch.

How It Works

1. Employee clicks a simulated phishing link
2. GoPhish records the click event in campaign results
3. Employee is served a training landing page with a 5-question interactive quiz
4. Quiz covers red flags in the specific email, reporting procedures, and best practices
5. On completion, the quiz score and answers are submitted back to GoPhish as campaign data
6. Your campaign report shows click rate, quiz completion rate, and average score side by side

Why It Matters for Compliance

• PCI-DSS 12.6: Requires documented security awareness training — quiz completion records satisfy this
• HIPAA: Workforce training must be documented and measurable
• SOC 2: Auditors expect evidence of a training program, not just simulations
• Cyber Insurance: Carriers increasingly require documented SAT completion records
• Trend Tracking: Average quiz score per department over time shows training effectiveness

What the Quiz Covers

• Red flags in the specific phishing email (urgency, spoofed sender, suspicious links)
• Correct reporting procedure for your organization
• What NOT to do when you suspect a phishing email
• How to verify a sender's identity before clicking
• What to do if credentials were entered on a phishing page

Quiz templates are fully customizable HTML — adapt questions to your industry, policies, or specific campaign scenario.

Campaign Result Integration

Quiz completion is tracked natively through GoPhish's existing data capture — no external systems required. Each recipient's campaign record shows:

• Clicked link: Yes / No
• Training quiz completed: Yes / No
• Quiz score: X / 5
• Time to complete training
• Individual question responses (for audit)