Skip to content
Bexxo Help

Help PhishTrainer: campaigns

Create and launch a simulation campaign

For administrators PhishTrainer Updated on 13 November 2026

Administrator guide: create a phishing simulation campaign in PhishTrainer, test it, schedule it, follow its sending and duplicate it.
On this page
  1. Before you start
  2. Create a campaign
  3. Campaign settings
  4. Schedule the sending
  5. Send a test
  6. Check before launch
  7. Launch and follow the campaign
  8. Duplicate a campaign

Before you start

A campaign combines items you prepare in advance. You need:

  • at least one target group containing the people to test;
  • a phishing email: one of your own or a Bexxo template;
  • a landing page, the page that opens when a target clicks the link: one of your own or a Bexxo template;
  • a sending profile: one of your own or a Bexxo template (if your organization encrypts its data on the client side, only your own profiles are offered).

Only the PhishTrainer roles Supervisor and Administrator can create, edit, test or delete a campaign.

Before the first send: configure Microsoft 365 Defender to allow PhishTrainer simulations. Without this configuration, your simulation emails may be blocked, quarantined or have their links rewritten, and the results will be distorted.

To do once, before the first campaignAllow PhishTrainer in Microsoft 365 Defender

Create a campaign

  1. In the PhishTrainer menu of the extranet, open Campaigns.
  2. Click New Campaign. The form opens with two cards: Campaign settings and Sending schedule.
  3. Fill in the settings (see the table below). Fields marked with an asterisk are required.
  4. Enter the launch date and, if you wish, progressive sending.
  5. Click Save as draft to come back later, or Schedule to schedule the launch.

A draft sends nothing. It goes through the same checks as a scheduled campaign: all required fields must be filled in to save it.

Campaign settings

The Phishing, Landing page and Sending profile lists separate your own items from the Bexxo templates (Bexxo templates). Each email and page is shown with its brand and language.

FieldPurpose
NameInternal name of the campaign, 3 to 100 characters. Targets do not see it. Choose a name that makes it easy to find, for example "Q1 Sales fake invoice".
GroupsOne or more target groups. At least one is required.
PhishingThe simulation email sent to targets.
Landing pageThe page shown when a target clicks the link in the email.
Sending profileThe profile used to send the emails (sender and sending server).
Domain nameThe domain of the simulation links, chosen from the list of PhishTrainer domains. These are the domains to allow in Microsoft 365 Defender.
Format of links to the landing pageThe shape of the link address, from five families of examples (https://xyz.com/{code}/login, https://xyz.com/login?user={code}, https://xyz.com/files/contract_{code}.pdf…). {code} is replaced by an identifier unique to each recipient, which attributes each click.
Best practice reminder pageThe page offered to the target after submitting the landing page form: a Bexxo video or information page, an external site (Other websites) or your own address (Custom URL…). The eye button opens the selected page.

Tracking and privacy options

FieldPurpose
Track email image loading?Adds a tracking image to the email. Loading it records the opening. Without this option, no opening is measured.
Anonymize campaign results?The campaign results and export are shown without the targets' address, first name, last name or position. The counters remain complete.
Save submitted forms?Records the values a target enters in the landing page form. They appear in the target details. Password fields are removed unless the next option is enabled.
Save password fields?Visible only when the previous option is enabled. Also records password fields.

When you enable Save password fields?, the extranet shows the warning "This may contravene the data protection rights of the tested target." A phished target may enter a real password. Leave this option disabled unless there is a documented decision that complies with your data protection policy.

Schedule the sending

The Sending schedule card contains two dates, entered in Swiss time:

  • Launch date (required): when sending starts.
  • Progressive sending (optional): an end date, later than the launch date. Sends are then spread at regular intervals between the two dates. If left empty, all emails go out at the launch date.
  • Progressive sending prevents many colleagues from receiving the same email at the same moment and talking about it.

Send a test

The test sends you the email as a target will see it, with the selected phishing email, landing page, domain, link format and sending profile. Do it before every launch.

  1. Select at least the Phishing and the Landing page. Without them, the extranet shows "Please select a phishing email and a landing page first."
  2. Click Send a test. The Test sending window opens, prefilled with your details.
  3. Check or change First name, Last name and Email (required) and Position (optional). These values replace the personalization variables of the email.
  4. Click Send a test, confirm, then check in your inbox the look of the email, the link and the display of the landing page.

If your organization encrypts its data on the client side, the Send a test button is disabled and the extranet shows "Test sends are performed by your agent."

Organizations that encrypt their dataClient-side encryption

Check before launch

A wrong group or a mistake in the email can distort the results or harm the credibility of the simulation. Before clicking Schedule, check that:

  • Microsoft 365 Defender is configured for the PhishTrainer domains (first campaign).
  • The selected groups are the right ones and their members are up to date.
  • The phishing email and the landing page are in the targets' language.
  • The test was received, the link opens the right landing page and the best practice reminder page appears after the form is submitted.
  • The anonymization and form saving options match what was agreed internally.
  • The launch date and, if used, the progressive sending end date are correct (Swiss time).
  • The people who need to know (IT department, support) are aware that a simulation is running, so they do not treat reports as a real attack.

Launch and follow the campaign

  1. Click Schedule.
  2. Confirm "Do you want to schedule this campaign?". The campaign moves to the Scheduled status.

At the launch date, the campaign moves to In progress and the recipient list is built from the group members at that moment. A person who belongs to several groups of the campaign receives only one email.

Campaign statuses

StatusWhat you can do
DraftNothing is sent. Edit (pencil icon), schedule, duplicate or delete.
ScheduledWaiting for the launch date. Edit all settings (the Save as draft button is no longer offered), view the results, duplicate or delete.
In progressSending has started. The campaign can no longer be edited (eye icon to view it). Follow the results, close it, duplicate or delete.
CompletedThe campaign has been closed. It moves to the Archived Campaigns tab. Its results remain available. The simulation links no longer lead to the landing page.

Follow and stop a campaign

The Active Campaigns tab lists draft, scheduled and in-progress campaigns; Archived Campaigns lists completed campaigns. The chart icon opens the results, which fill in as emails are sent and targets act. Each send has a status there: Scheduled, Sent, Error or Retry.

A campaign stays in progress until you close it. To stop it, open its results and click Campaign completed: pending sends are stopped and the campaign is archived.

Deleting a campaign (trash icon in the list, or the Delete button in the form) also erases its sends and all its results. This cannot be undone. To keep the statistics, close the campaign instead of deleting it.

Read the results of a campaignRead and export the results

Duplicate a campaign

Duplication takes an existing campaign, whatever its status, as the starting point of a new one. Use it, for example, to repeat a simulation at regular intervals or to change a single item (the group or the email).

  1. In Campaigns, click the copy icon of the campaign to reuse.
  2. The form opens with all the settings of the original: groups, email, landing page, sending profile, domain, link format, reminder page, options and dates. The name is followed by "(Copy)".
  3. Rename the campaign, adjust at least the Launch date and check the groups, then save as draft or schedule.

The copy is a new campaign: the original and its results are not changed.

Didn’t find the answer? Contact us