📋 GRC compliance for CMMC 2.0, CPCSC, CPA Canada, IIROC…SaaS discovery for data governanceFree enriched web chat widget🚀 Enriched remote support without your laptop

Phishing Simulations

Send realistic, safe phishing tests to your staff, see who clicks, and show them what to look for next time.

Where to find it
Security awareness training › Phishing Simulations
Who can use it
Anyone who can see the page
Plan
Security awareness training
For
MSPs

What the page is for

A phishing simulation sends a fake phishing email to staff to measure who clicks and who enters their password. People who click land on an educational page that explains the red flags they missed. Over time, click rates show whether training is working.

This page is where you run campaigns and manage the pieces they use. Templates are the simulated emails; Lavawall provides a library in categories such as credential harvest, IT helpdesk, invoice or CEO fraud, delivery and Canada Revenue Agency, and you can write your own. Landing Pages are the educational pages people see after clicking. Import Email turns a real phishing email you received into a safe template, with tracking, scripts and malicious links removed.

Campaigns can target training groups, individual people or all active users, and can be sent now or scheduled.

What you see

The Phishing Simulations page, with the summary figures, tabs, campaign cards and new phishing simulation campaign numbered 1 to 4.
The Phishing Simulations page. Numbers match the list below.
  1. Summary figures: Campaigns, Templates, Emails Sent and Link Clicks.
  2. Tabs: Campaigns, Templates, Landing Pages and Import Email.
  3. Campaign cards: name and status (draft, active, paused or completed), Sent, Clicked, Creds Entered and Click Rate, the template and send date, and Report. New Campaign starts a new one.
  4. New Phishing Simulation Campaign: Campaign Name, Schedule Send, Email Template, Educational Landing Page and Who to target (Training Groups, Individual Emails or All Active Users), with Save as Draft and Create Campaign.

How to run a phishing simulation

  1. On Campaigns, click New Campaign.
  2. Enter a Campaign Name.
  3. Choose an Email Template and, optionally, an Educational Landing Page (or keep the default).
  4. Under Who to target, choose Training Groups and tick groups, Individual Emails and search for people, or All Active Users.
  5. Set Schedule Send, or leave it blank to keep a draft.
  6. Click Create Campaign, or Save as Draft to finish later.
  7. Watch Clicked, Creds Entered and Click Rate on the campaign card.

How to write your own template

  1. Open Templates and click New Template.
  2. Enter a Template Name, Difficulty (Easy, Medium, Hard or Expert) and Category.
  3. Enter the From Name, From Email and Subject Line.
  4. Write the Email Body. Use the { } toolbar button to insert placeholders such as the person's first name, company name and the simulated phishing link.
  5. List the Red Flags, one per line. They are shown on the landing page.
  6. Save the template.

How to create an educational landing page

  1. Open Landing Pages and click New Page.
  2. Enter a Page Name and Page Title.
  3. Write an optional Intro Message and the Educational Content.
  4. Tick Include credential collection form only if you want to measure whether people enter a password.
  5. Save the page. Use the preview button to check it.

How to turn a real phishing email into a template

  1. Save the phishing email as a .eml file from Outlook or your email client.
  2. Open Import Email, choose the file in Select .eml file and click Import & Sanitize.
  3. The new template appears under Templates, ready to edit and use.

Tips

  • Start with an Easy or Medium template, then increase difficulty as click rates fall.
  • Click Rate turns amber above 10% and red above 30%.
  • Templates and landing pages marked Global are provided by Lavawall. You can preview them but only edit your own.
  • Use Training Groups to test one department at a time; add the groups on the Training page.
  • When staff report a simulation with the Phishing Reporter add-in, they are credited for catching it automatically.

Troubleshooting

  • "No campaigns yet. Create your first campaign." Click New Campaign.
  • No training groups to pick. Create groups on the Training page first, then click the refresh button in the campaign form.
  • "No templates found." Set the category filter back to All categories.
  • There is no edit button on a template or landing page. It is a Global item provided by Lavawall. Import or create your own to customize it.

Task guides that use this page

Still need help?

Search the support centre, or contact our support team and tell us which page you were on.

Names, companies, devices and figures in the pictures are examples. Other product and company names are trademarks of their respective owners.

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.