Help Getting started
Getting started with PhishTrainer
On this page
What PhishTrainer does
PhishTrainer trains your employees to recognize phishing. It sends simulated emails or SMS messages, realistic but harmless, and records how each target reacts: opening the email, clicking the link, entering data on the landing page, reporting the email.
You use these results to:
- measure how alert your teams are;
- identify the people and groups who need training;
- track how the results change from one campaign to the next.
Who uses PhishTrainer in your organization
- the chief information security officer (CISO): assesses the risk and tracks progress;
- the IT and security teams: prepare campaigns and handle reported emails;
- human resources and training: include the results in awareness programs;
- management: views the results in read-only mode.
Each person gets the role that matches their use: see “Give your colleagues access”.
Key terms
These terms appear in the interface and in the other guides.
| Term | Definition |
|---|---|
| Phishing | A fraudulent message that impersonates a trusted sender to obtain credentials, information or a payment. |
| Simulation | A fake phishing email or SMS sent by PhishTrainer for training purposes. It poses no risk to the person who receives it. |
| Target | A person in your organization who receives the simulations. Menu Targets. |
| Target group | A set of targets (department, site, job…) that you send a campaign to. Menu Target groups. |
| Phishing template | The content of the simulated email or SMS. Menus Phishing templates and Phishing SMS; templates supplied by Bexxo are under the Templates bexxo tab. |
| Landing page | The web page that opens when the target clicks the link in the simulation. It can imitate a sign-in page. Menu Landing pages. |
| Sending profile | The SMTP server and sender address used to send simulated emails. Menu Settings > Sending profiles. |
| Campaign | A scheduled sending of a simulation to one or more groups, with a phishing template, a landing page and a sending profile. Menu Campaigns. |
| Suspicious email | An email reported by an employee (simulation or real message). You classify them in the Suspicious emails menu. |
| Click rate | The share of targets who clicked the link in a simulation. With the data-submission rate and the reporting rate, it is one of the indicators tracked in the results. |
First sign-in
Bexxo opens your organization’s space and creates your first access. You then receive your sign-in details by email.
- Open
https://app.phishtrainer.comin your browser. - Enter your email address in User and your password in Password, then click Validate.
- If two-factor authentication is enabled on your account, enter the 6-digit code received by email or shown in your authenticator app.
- If your account gives access to several organizations, choose the one you want to work with.
- In the left menu, open PhishTrainer under “Services”, then Dashboard.
If your organization has enabled client-side encryption, you also enter your passphrase. The “Client-side encryption” guide explains how this works.
Replace the password received by email when you first sign in, in My profile.
Your profile
Open My profile in the “General” section of the left menu. The page has four blocks:
- My avatar: choose the image linked to your account.
- Personal information: correct your last name, first name and phone numbers. The email address cannot be changed here: contact support.
- Change password: at least 12 characters, including an uppercase letter, a lowercase letter, a digit and a special character.
- Two-factor authentication: Enable via e-mail (a code sent at each sign-in) or Enable via app (a code generated by an authenticator app, after scanning a QR code).
Enable two-factor authentication on the accounts that administer PhishTrainer: they give access to the results of the whole organization.
Finding your way around
PhishTrainer is in the left menu, under “Services”. The entries you see depend on your PhishTrainer role.
| Menu entry | Content | Visible from role |
|---|---|---|
| Dashboard | Statistics of your campaigns (emails opened, links clicked, data submitted), details per campaign and suspicious emails from the last 30 days. | Viewer |
| Target groups | Target groups and their statistics. | Supervisor |
| Targets | Results per target: sends, click rate, data-submission rate. | Supervisor |
| Campaigns | Creating, scheduling and viewing the results of email or SMS campaigns. | Supervisor |
| Suspicious emails | Emails reported by your employees, to analyse and classify. | Supervisor |
| Phishing templates, Phishing SMS | Simulation content: your own and the content supplied by Bexxo. | Supervisor |
| Landing pages | Pages shown after a click on the link in a simulation. | Supervisor |
| Settings | Sending profiles, Réception des signalements (mailboxes and add-ins that forward reported emails) and Webhooks. | Administrator |
| Help | PhishTrainer online help. | All roles |
The “My organization” menu
Under “Administration”, the My organization menu groups the settings shared by all Bexxo services: People, Groups, Directory and SSO, Email sending, Support access, and Encryption if your organization has enabled it.
The account administrator sees all these entries. A person with the Manage people permission sees People, Groups and Directory and SSO.
Give your colleagues access
The people in your organization are managed in My organization > People. For each person, you choose which services they can access and their role in each one.
PhishTrainer roles
| Role | What the person can do |
|---|---|
| Target | Receives the simulations. Does not see the PhishTrainer interface. |
| Viewer | Same as Target, and views campaigns and results in read-only mode. |
| Supervisor | Same as Viewer, and creates and manages campaigns, groups and templates. |
| Administrator | Same as Supervisor, with full access to configuration (Settings) and billing. |
The PhishTrainer role is separate from the account administrator status (badge Account administrator), which gives access to the My organization menu.
Add a person
- Open My organization > People, then click Add a person.
- Fill in Last name, First name, E-mail and Correspondence language, then click Save.
- In the Services & permissions block, choose the person’s PhishTrainer role, then click Save permissions.
- If the person needs to sign in, click Generate access in the Account access block. They receive an email with their sign-in details.
The services offered depend on your organization’s subscription. A person who only has the Target role does not see the PhishTrainer interface.
Add several people
- CSV file: download the CSV template, fill it in, then use Import a CSV.
- Bulk actions: tick people in the list, then use Create access or Change services.
- Directory synchronization: people and groups from Microsoft Entra ID can be imported automatically (Directory and SSO).
Manage existing people
- Change role: open the person’s record and change their role in Services & permissions.
- Password: Reset password sends the person an email.
- Remove access to PhishTrainer: set the service to Inactive on their record, or tick the person in the list and use Remove access.
Running a simulation ethically
A simulation is there to train, not to trap or punish. These practices preserve your employees’ trust.
- Inform: announce the simulation program to your employees (and, where applicable, to their representatives) and explain its purpose. There is no need to announce the dates and times of campaigns.
- Train: after each campaign, explain the clues that revealed the simulation. In the campaign, the Best practice reminder page: offers awareness pages and videos, or your own address.
- Protect privacy: tick Anonymize campaign results? if you track trends rather than individuals. Once the campaign is complete, Anonymize data permanently deletes the targets’ personal data and keeps the statistics. Enable Save submitted forms? only if you need it, and decide who views this data and how long you keep it.
- Stay proportionate: avoid scenarios that are stressful, discriminatory or touch on private life. Start with simulations that are easy to spot, then increase the difficulty.
- Comply with the law: check that your program meets the data protection and workplace monitoring rules that apply to you (FADP in Switzerland, GDPR in the European Union).
The Save password fields? option records the passwords entered by targets. The interface warns: “This may contravene the data protection rights of the tested target.” Leave it disabled unless there is an explicit internal decision.
Next steps
Prepare your targets and groups, then create your first campaign.
Didn’t find the answer? Contact us