Phish Threat
Suggest, discuss, and vote on new ideas for Sophos Phish Threat. Phishing attack simulation and training for your end users.
-
Anonymization/Pseudonymization of users
While administrators and managers shall be able see on a per-campaign-basis the percentage of tests which failed and trainings which were begun/finished - they must not see the individual results of each users.
The users must not be displayed in clear text, only anonymized/pseudonomized.
Access to this individual information must only be accessible either using 4-eyes-principle authentication for this information or by creating a special administrator role which may see this kind of personally identifiable information.54 votesWe are currently considering how best to do this in a way that is effective and retains as much useful reporting functionality as possible.
-
Ability to upload/ edit training material
Can it please be considered for customers to have the ability to upload their own training documents or videos? Or modify the exiting training documents?
Customers might like to add their own training material into the Phish Threat site so it's more in line with their company. Would you please consider this or would we be reluctant to do so as we have some sort of duty to ensure the training is of sufficient quality and that covers the security topic well enough?
44 votesAwaiting reply from Submitter ·AdminRussell Petrich (Admin, Sophos Features & Ideas Laboratory) responded
Since the original posting of this idea, we have implemented the ability to use custom training content instead of the modules provided by Phish Threat (see attached screenshot).
Does this functionality address the general need you expressed in the original post?
-
Assign multiple training for a training only campaign
Currently, it appears you are only allowed to choose 1 training for a training campaign. For us, it is a requirement to assign multiple videos/training to users. For example, we would like to assign both "Intro to Phishing and Password Overview" to all users in our organization to meet policy requirements. However, it is cumbersome and confusing to users if we assign multiple campaigns. Users then get multiple emails. Please introduce the feature to assign multiple training for one campaign.
31 votesThanks for all the feedback on this. We’ll look into this further to determine its feasibility – keeping in mind that there would be some limitations on this functionality once implemented.
Thanks,
Russell -
Save and Continue
I would like to request the ability to save and continue a campaign that I'm creating. I can't always run through the steps from start to finish without interruptions (or need to gather info). In v1 there was no Save and Continue option, but the program saved the campaign automatically.
28 votesDevelopment is underway on this feature. We hope to have this available by August 2020.
-
Need more options for training email reminders frequency
It appears that there is currently only the option to email users daily if they have not completed their training or to disable the reminders completely. It would be beneficial to be able to change the frequency of these emails and to specify when to start sending reminders.
1. Please allow the option to choose the amount of days between reminders. At a minimum allow to choose 1 to 7 days.
2. Allow to select when to start sending reminders. For example, if the campaign runs for 2 months, start sending reminders at the 1 month mark, and then send…23 votesThis functionality is currently under development. We hope to have this completed before the end of this month (June 2020).
Apologies for the lack of updates on this.
Best regards,
Russell -
Export Reports to PDF in Current View
I see that the option is now available to export Phish Threat reports to a CSV.
It would be great for reporting and records purposes if we also had the option to Export as PDF in Current View, similar to the Export PDF of Current View option that is available when viewing DLP Events Logs.
Currently exporting the CSV file spits out all the possible data on a campaign, including irrelevant data (such as in General Phishing campaigns, the CSV report includes fields for Attachments and Credential Harvesting). Exporting the Current View would be much more helpful for reporting and…
19 votesWe definitely see the benefit of implementing this functionality and plan to do so. However, this will likely not be added to the product until next year (2021).
Best regards,
Russell -
Ability to manually add "reported" phishing email by user
Ability to manually add "reported" phishing email by user
18 votesThis functionality is planned for release during Q4 of this year (2020).
-
Phish Threat Training Concept
Phish Threat Training Suggestion To Help IT with End Users
I was responding to another post and had this thought, I wanted to see what others think of it, the goal is to better incorporate the training before the test.Currently sending an email for training in something you failed at in an email creates to much tension, end users can simply tell their boss they thought it was another test so they ignored the email. Bosses just don't want the breach so they encourage the training but also understand the end users point since they are just being extra…
16 votes -
Remove users from in-progress campaigns
We should be able to remove users from running campaigns as our training campaigns could run for weeks and people can leave the organisation during the campaign.
15 votes -
Automated Reporting / Scheduled Reports
It would be great to have a way to set up automated/scheduled reports to be emailed.
This feature would allow us to easily provide reports to our management team and compliance officers on a consistent schedule without having to tie up an administrators time pulling reports, exporting them and compiling them into email.15 votes -
Emailed certificate once training is complete
In V1 there was a certificate of completion emailed to each user, once the training had been completed, will that come in V2 as well? It would be good for tracking purposes within our organization.
14 votes -
domain
Add ability to add domains.
For example if I registered sophsos.com, I would like to be able to add it to my Phish Threat account and use it for a campaign.
14 votes -
Better support for Incomplete Training
Given our trainings require 100% completion/pass, it would be nice to see the Campaign Dashboard include a bar graph for "Incomplete Training", something i can click on, and see who hasn't completed yet. Further, a "resend training" button would be great, to resend to an individual or to all users who haven't completed training yet.
Currently i have to go to Export Data to figure this out, cut/paste their email and link from the spreadsheet, and send to them.
It is also difficult to determine who has completed but not passed. Currently i have to export all results to CSV,…
14 votes -
Phish Threat Reporting
It would be great to integrate Phish Reporting with G Suite Gmail and not only Outlook.
13 votes -
Rename or update an existing campain
It would be helpful to have the ability to edit an exisitng campain so that you can rename it, maybe add more users etc.
13 votes -
Phish Threat Admin Role needed
To access Phish Threat, a user has to be granted Admin role. I would like more granual control over roles and permissions, so i can give the ownership of Phish Threat to someone without giving them access to everything else - Encryption, Endpoint Protection, Email Gateway, etc.
13 votes -
Specify Work Hours
It would be nice if we could specify our normal business hours under General Settings or for a specific campaign so that emails would only be sent out during that time frame. We're finding that some users are not seeing emails due to sending out at odd hours.
12 votes -
Add Users to New Campagin
I would like the ability to add a group of users to a new campaign from the campaign results screen.
The idea would be to look at the employee data from one campaign and take all of the users that failed and add them to another campaign in one fell swoop. That way we can target users that failed with another campaign soon after.
12 votes -
SMTP Configuration - Add "Send As" Field or modify use of "Sender Name" Field
Phish Threat SMTP configuration allows the admin to specify a Sender Name which populates part of the the FROM header field on the message. This is not the same as specifying "Send As" which would allow for the proper use of SMTP aliases.
Currently in the case the primary SMTP address used to authenticate to the mail server only authenticated primary SMTP address is used for the sender.
Example:
Sender Name: Helpdesk
Username: support@example.comResults in the mail properties headers
From: Helpdesk <support@example.com>
and
Return-Path: support@example.comMeanwhile the mail client displays identity of the authenticating account and not…
11 votesThanks for the suggestion. We are considering this for a future update of Phish Threat.
-
Report Message Addin for Outlook Mobile app
Make the "Report Message" add-in accessible from Microsoft's Outlook app for mobile devices. This would help users report messages from their phone in the same way they are reporting them while at their desk.
10 votes
- Don't see your idea?