Safe exercises
Simulation campaigns require manager approval and authorized delivery. Their purpose is to practice verification and reporting with constructive coaching—not to surprise employees into a disciplinary record.
See a safe scenario in the guided demo →Templates exclude payroll, layoff, and medical scares from new US campaigns. Protected accounts are excluded by default; passwords, payments, and sensitive form contents are not collected. Correct reporting gets positive feedback and no automatic discipline is triggered.
A delivered message and page view are distinct events. A page visit or scanner visit does not count as failure. The employee makes an explicit safe or unsafe choice on the landing page. Managers can inspect the event timeline and correct disputed unsafe results; the original event and correction remain visible.
Live sending stays disabled until a verified sender path is authorized. The manager lab shows delivery readiness. Microsoft 365 authorization is configuration-dependent; broad compatibility across Defender, Proofpoint, Barracuda, Mimecast, and Google Workspace has not been validated publicly. Pilot the mail stack before relying on campaign comparisons.
The landing page identifies warning signs, suggests an independent verification path, and recognizes safe reporting. Managers can review an event and remove a disputed failure from counts and CSV export with a recorded reason.
Page visits and recognized scanner events are not counted as unsafe decisions. Managers should still review disputed records.
A manager can examine event provenance and record a correction without deleting the original event.