Account Settings

Overview

The Account Settings page allows for the configuration of default settings for campaigns, account notifications, portal user password policy, portal SSO, MFA, Webhook, AI, and Department settings. 

To get started, navigate to Administration > Settings > Account Settings.

Use the links below to jump to a section:

1. General
2. Notifications
3. Passwords
4. SSO
5. MFA
6. Webhook
7. AI
8. Departments

General

The General tab lets you specify certain default settings on your account.

Group & Target Settings

• Group Import Type - This specifies how the system will handle imports when an attempt is made to import more targets than the account is provisioned to hold. There are three options to configure how the Portal handles this case:
  • Stop and do not import - The import will fail entirely. No targets will be imported. When inspecting the Download Log from the import, the targets will be marked as skipped, with a message indicating that the target exceeds the accounts seat provision. 
  • Import up to the available amount - Imports targets up to the available amount of seats provisioned for the account, and then stops importing once that limit is reached. 
  • Import all and send a bill for the overage - This will import all targets and will send a bill for the amount of targets that exceeded the account seat provision. 
• Department Mapping - When enabled, the targets with departments will be mapped to a system defined department category. This mapping will be used in the campaign wizard for template suggestions. 
• Title Mapping - When enabled, targets with titles will be mapped to a system-defined job category. This will be used when calculating a targets Risk Score. 

Testing Defaults 

• Default Time Zone - This setting will be automatically set in the Date/Time dropdowns in the Campaign Wizard, and can be modified during campaign setup. 
• Default Email Rate Limit - The rate of emails (per hour) that will be sent out for the "Immediate Test" type. The minimum send rate is 10 emails (per hour). There is no upper limit to the sending rate. However, some firewalls will block phishing emails when too many are sent over a short period of time. If this is a pressing concern, we recommend to start out with a relatively low sending rate (such as 300 per hour) and gradually increasing this value over time as more tests are ran. 
• Default Test Length - This setting defines the default length of how long tests will run. This value will be populated in the Campaign Wizard and can be modified during campaign setup.

Report Defaults 

• Default Date Format for Reports - The default date format displayed in Report Generator. 
• Default Time Format for Reports - The default time format displayed in Report Generator.
• Generated Report Storage Period - The number, in years, that reports that are generated and saved to the platform will be kept. 

Portal User Settings

• Maximum allowed Session timeout - The maximum amount of time users can be logged in for a given session; any users with a session timeout that exceeds the limit set here will have their timeout automatically reduced to the new maximum. The options for this setting are:
  • 30 minutes, 
  • 1 hour, 
  • 2 hours,
  • 4 hours, 
  • 8 hours, and
  • 24 hours. 

We recommend that an organization perform an analysis regarding what value is chosen for this setting, as there is a tradeoff between security (a low maximum) and convenience/ease of use (a high maximum). 

Template Automation

• Vendors - This setting contains a list of vendors that, when selected here, will pre-populate the venders field within the Template Library allowing for automatic filtering of templates, streamlining the process of template selection. 

Back to top

Notifications

The Notifications tab allows you specify an account manager name, email address, and language, and provides several notification options you can enable/disable:

• Group Sync Notification - A group_sync_complete system email is sent to all admins on the account letting them know when integrated groups (such as Entra ID, LDAP or Litmos) are synced.
• Failed Auto Sync Notification - An email that is sent to the account manager email address when an integration's automatic sync fails.
• Flagged Domain Notification - An email is sent to the account manager email address when a domain that is being used in active tests is flagged (a domain may become flagged if it is marked as malicious by third party security software).
• Account No Usage Reminder - An email is sent to all admins to remind them to run a Phishing Campaign after 90 days of inactivity.
• Report Generated Notification - An email is sent to the user who queued for the report when their report is generated.

NOTE: Campaign notifications can be configured on the Review tab of the Campaign Wizard. 

Back to top

Passwords

The Passwords tab allows for the configuration of various requirements that users must meet when creating/setting a new password. The requirements available for configuration are as follows:

• Enforce minimum password length, 
• Require at least one uppercase letter in the Latin Alphabet (A-Z), 
• Require at least one number (0-9), 
• Require at least one non-alphanumeric character (e.g., ! @ # $ % ^ & * ( ) - _ + [ ] { } |), 
• Enable password expiration, 
• Prevent password reuse, 
• Prevent users from using common/blacklisted passwords. 

Back to top

SSO

The SSO tab lets you configure Single Sign On for the Portal account (School SSO can be configured in School Settings). Simply choose from the available different SSO solutions (OneLogin, Okta, PingOne, Azure, and Google Workspace). 

NOTE: If a user is provided access to the Portal via your organization's SSO IDP, and does not already have an account in Portal, (in Administration>Manage Portal Users), an account will automatically be created with a role of "Admin" when the user accesses the phishing portal via SSO.

• Lock SSO Portal - If enabled, administrators can log in to the portal via SSO only. If the SSO configuration fails and administrators can no longer log in, contact our Support team.

  NOTE: Portal MFA lock must be disabled to use SSO portal lock. 

• App embed link - Input the desired SSO app's access URL here. When a URL is provided here, a link to this URL will be included in system emails. If there is no URL provided, the system email will just include plain text stating they must login via SSO. 
• Signed Logout - Set this to "Yes" if your IDP requires signed single log out requests.
• Attribute Mappings - Specify users provisioned via SSO to be set with User privileges (users provisioned via SSO will have Admin privileges by default). This is done by specifying an attribute name and value to identify the user. If a name is duplicated, it will be treated as an array. The array will be parsed for the given value to determine how the field should be assigned. Below are the following Field options:
  • First Name - Specify an attribute Name whose Value will be used as the created user's first name.
  • Last Name - Specify an attribute Name whose Value will be used as the created user's last name.
  • Admin - Specify an attribute key-value pair that when matched will assign the admin role.

  • User - Specify an attribute key-value pair that when matched will assign the user role.

    NOTE: Attribute mappings are optional. They are not required for SSO to function.

Back to top

MFA

The MFA tab contains two MFA Lock toggles to enable/disable required MFA for all users. The two toggles are:

• Portal MFA Lock - When enabled, it will require all portal users to configure MFA for the Portal site. 
• School MFA Lock - When enabled, it will require all students to configure MFA for the School site. 

Back to top

Webhook

The Webhook tab provides access to all account settings related to webhooks.

• Default Verified Action Webhook (Recommended) - When a verified action is recorded, the system sends a JSON response to the Default Verified Action Webhook URL. If a specific Verified Webhook URL is defined for a campaign, this URL will override the default and receive the response instead.
• Default Webhook (Deprecated) - When any action (verified or not) is recorded, the system sends a JSON response to the Default Webhook (Deprecated) URL. If a specific Webhook URL (Deprecated) is defined for a campaign, this URL will override the default and receive the response instead.
• Custom HTTP headers - Add custom HTTP headers to webhook requests. 

Back to top

AI

• Configure an AI provider
  Opens the Integration Store, where you can add OpenAI or Anthropic configurations. You must configure a connection before other options are displayed.

• Default Model

  If you have an AI provider configured, the dropdowns will include any models associated with your API key. The selected model will be the default used by the feature. 

• Save
  Saves your selected model settings.

Departments

Departments are a target field that can be used to help suggest templates in the campaign wizard. To access the Departments tab, turn on the Department Mapping setting on the General Tab.  The table will list all the custom departments assigned to targets in your account. Clicking the actions dropdown allows you to delete or edit the department mapping. Editing the department will allow you to assign a best match to the targets department. To make best use of the template suggestion feature make sure map all the custom departments to our standardized list of departments. See the full list of departments below:

Accounting, Administration/Executive, All Staff, Business Development, Communications, Compliance, Customer Service, Data Analyst, Engineering, Facilities (physical plant), Finance, Human Resources (HR), Information Technology (IT), Legal, Logistics, Marketing, Operations, Payroll, Product Development, Project Management, Public Relations, Purchasing, Quality Assurance, Research and Development (R&D), Sales, Supply Chain, Technical Support. 

Back to top