¶ Scenarios
Scenarios are the phishing email templates sent to your targets. Each scenario defines the email content, format, and appearance that employees will receive during a campaign. Access this section from the left sidebar.
¶ Scenarios Overview
The Scenarios page shows all your email templates with options to:
- Search — filter scenarios by name
- Switch view — toggle between grid and list views
Three action buttons are available at the top:
| Button | Description |
|---|---|
| New scenario | Create a scenario from scratch (AI or manual) |
| Catalogue | Browse pre-built community scenarios |
| New scenario from email | Create a scenario by forwarding a real phishing email |
Note: If no scenarios exist, the page displays: "No scenarios: Please create a scenario"
¶ Creating a New Scenario
Click New scenario to open the creation dialog. You'll see two tabs:
¶ New Scenario IA (AI-Generated)
The AI-powered mode generates realistic phishing emails automatically based on your environment configuration.
| Field | Required | Description |
|---|---|---|
| Environment | Yes | Select the environment (phishing theme/sender profile) to use |
| Number of scenarios | No | How many variations to generate (default: 1) |
| Targeted groups | No | Optionally target specific groups — the AI can personalize content |
| Format | Yes | Choose the output format |
¶ Format Options
| Format | Description |
|---|---|
| Email (HTML) | Standard HTML email — the most common format |
| Email (MJML) | MJML responsive email markup |
| SMS | Text message format for SMS-based phishing |
Tip: If you choose one or more groups, the AI can tailor the phishing email to the group's characteristics (department, role, etc.), making the simulation more realistic.
¶ Manuel (Manual)
The manual mode gives you full control over the email template. You write the HTML/content yourself using the built-in editor.
This mode is best for:
- Replicating a specific real-world phishing email
- Creating highly customized templates
- Testing a particular social engineering technique
¶ Scenario Catalogue
Click Catalogue to browse a library of pre-built phishing scenarios created by the community and team.
Features:
- Filter by environment — use the "My environments" filter to see scenarios compatible with your configured environments
- Preview — view how each scenario looks before using it
- One-click import — add any catalogue scenario to your account
Tip: Look for the "Verified" badge for quality-assured templates.
¶ New Scenario from Email
Click New scenario from email to create a scenario based on a real email.
This feature uses Forward Email — you forward an actual phishing email (or any email you want to simulate) to a designated address, and it is automatically converted into a reusable scenario template.
This is particularly useful for:
- Reproducing real phishing attacks your organization has received
- Training employees to recognize specific threats targeting your industry
- Quickly building a library of realistic scenarios
¶ Template Variables
When writing manual scenarios, you can use dynamic variables that are replaced with real data at send time. Common variables include:
| Variable | Description |
|---|---|
{{.FirstName}} |
Recipient's first name |
{{.LastName}} |
Recipient's last name |
{{.Email}} |
Recipient's email address |
{{.Position}} |
Recipient's job title |
{{.From}} |
Sender email address |
{{.URL}} |
Phishing landing page URL |
{{.TrackingURL}} |
Tracking pixel URL |
{{.Tracker}} |
Embedded tracking pixel <img> tag |
For the complete list, see Template Variables Reference.
¶ Best Practices
- Mix AI and manual scenarios — AI provides volume, manual provides precision
- Use the catalogue — don't reinvent the wheel; verified templates are battle-tested
- Rotate scenarios — don't reuse the same template; employees will learn to recognize it
- Match the environment — ensure your scenario content aligns with the sender identity (e.g., a Microsoft-themed email should come from a Microsoft-like environment)
- Increase difficulty gradually — start with obvious phishing, then progress to more sophisticated scenarios
- Test before sending — always preview your scenario and send a test email to yourself first
- Set up explanation emails — configure an explanation email for each scenario so targets receive awareness content after campaign completion. See Explanation Email