Reviewing campaign data is essential to understanding employee behavior across your organization.

Human vigilance can become the first firewall of your company.

To do this, three conditions must be met:

Ensure employees have the theoretical knowledge required to recognize a threat.
Ensure they apply this knowledge when facing a real, sometimes subtle threat.
Ensure they become proactive in reporting suspicious activity.

1 – Objectives

Understand the evolution and results of a phishing campaign
Analyze employee behavior when exposed to threats
Measure the overall performance of a campaign
Identify improvement areas to strengthen human security

2 – Prerequisites

Access to the Phishing Simulation module
At least one campaign completed or in progress
Necessary rights to view detailed campaign data

3 – Access campaign data

3.1 – Access the campaign list

Click Campaigns in the Phishing section of the left-hand menu.

Campaigns are sorted in three tabs: Active, Completed and Archived. You can also search for a campaign by name or filter the list by Type. The Recurring tab lists automated campaigns.

Arsen campaign list with the Campaigns and Recurring tabs, the Active, Completed and Archived filters and the status of each campaign

3.2 – Open a campaign’s data

Click the campaign name to view all associated information.

The header summarizes the campaign: number of scenarios, number of targets, launch date, Failure mode and After failure (what happens once an employee falls for the simulation, for example a redirection or just-in-time training).

4 – View the campaign timeline

Review the timeline at the top of the page to understand the different statuses the campaign goes through:

Scheduled: the campaign is planned
Sent: emails are being sent, within the planned sending period
Collecting results: employees can still interact with the emails. The number of days left and the date of the automatic computation are displayed
Completed: the results are final and a summary of the clicks, submitted credentials and reports is displayed

Page of a campaign in progress with the timeline Scheduled, Sent, Collecting results and Completed, the How targets responded chart, the Clicks vs reports since delivery chart and the Breakdown table

💡 Good to know
While a campaign is in the Collecting results status, results are computed automatically on the date displayed. Click Compute results only if you do not want to wait for that date.

5 – Read campaign data

5.1 – See how targets responded

The How targets responded card shows one square per target, sorted by the most serious reaction:

Gave credentials
Clicked
Opened only
Not opened
Reported, marked on the squares of the targets who reported the email as suspicious

5.2 – Analyze reaction times

The Clicks vs reports since delivery chart plots, over time since delivery, the number of employees who clicked, who gave their credentials and who reported the email. Above the chart, the key figures tell you within how much time half of the clicks happened, and how long after clicking half of the employees gave their credentials.

5.3 – Compare scenarios

The Breakdown table gives, for the whole campaign and for each scenario, the percentage of employees who opened the email, clicked, gave their credentials and reported it. The colors go from better to worse results, and scenarios that reached too few employees are not compared until you click Show it.

5.4 – Check the delivery

The Delivery card shows the number of emails delivered, the number of bounces and how long the sending took.

📚 Note
Two types of bounces exist:

Hard bounce: the email can never be delivered
Soft bounce: the email is temporarily undeliverable; another attempt will be made

⚠️ The bounce counter is cumulative, even if the email is eventually delivered.

5.5 – View the security score

Once the campaign is Completed, the Security score obtained for this campaign is displayed next to the timeline, out of 100.

6 – View a collaborator’s event history

6.1 – Browse the targets

The Targets table lists every employee of the campaign, with their groups, the scenario they received and their Journey, a visual summary of how far the employee went in the campaign.

Use the All, Clicked, Gave credentials and Reported tabs to focus on a behavior
Click More filters or use the search bar to find a name, an email, a group or a scenario

Delivery card and Targets table of a campaign in Arsen with the All, Clicked, Gave credentials and Reported tabs, the scenario and the journey of each employee

6.2 – Access detailed user activity

Click a target to open the detail panel and see all the actions this collaborator performed during the campaign:

the exact time of each event: sent, delivered, opened, clicked, credentials submitted, reported, with the delay since the previous step
Expand all to display the details of every event
Preview to see the email the collaborator received
the arrows, or the J and K keys, to move to the next or previous target

Detail panel of a target in Arsen showing the events Sent, Delivered, Opened the email and Clicked the link with the delay between each step

7 – Export campaign data

7.1 – Export the campaign

The campaign must be in Completed status.

Click Export CSV at the top right of the page: the file is a structured spreadsheet of the campaign results.

Completed campaign in Arsen with the Export CSV button at the top right, the security score and the summary of the Completed step

7.2 – Export a list of targets

Under the Targets table, click Export this list to export only the targets currently displayed, for example those who gave their credentials.

The ⋮ menu next to Export CSV lets you Archive the campaign once you no longer need it in the Active or Completed lists.

Ongoing Campaign Progress