Read phishing activity

When a client asks “how are our phishing tests going?”, Risk → Phishing is the answer. It’s the activity log of every phishing test we’ve sent to that client’s users — automatic rotation and on-demand sends, all in one place.

Risk → Phishing activity page with filters and event log

The page

Open the client → Risk → Phishing. The page is built around three things: a counter at the top, a filter bar, and an event list.

The counter

Shows the total events matching your current filters (default: last 90 days, all statuses, all users).

The filter bar

Date range — Last 7 days, Last 30 days, Last 90 days (default), Last 6 months, Last year, All time.
Status — chips for each status (see below). Click to filter; click again to remove. Multi-select.
User — search by name or email, pick one user. Click Clear to reset.
Search — finds tests by subject, recipient, or sender.
Clear filters appears whenever you’re not at defaults.

The event list

One row per phishing test sent. Each row shows the user, the test’s subject, who it was “from,” sent timestamp, the current status, and when that status was reached. Click a row to drill into the individual result.

What each status means

Six statuses you’ll see, in roughly increasing severity:

Sent — neutral. The test was delivered; the user hasn’t done anything yet.
Opened — warning. The user opened the email but didn’t act on it.
Clicked — danger. The user clicked a link in the test.
Reported — success. The user clicked the Report Phishing button, or an admin used Mark as Reported because the user reported it another way. This is the correct action and what you want to see.
Credentials Submitted — danger. The user clicked through to the simulated phishing site and entered credentials. Worst outcome.
Attachment Opened — danger. The user opened an attachment in an attachment-style test. Equivalent severity to Credentials Submitted.

Reported is the success state — it’s what training is for. A user reporting a test means they recognized it and used the right escape valve. Their result shows green.

A user can transition through multiple states for a single test — e.g., Sent → Opened → Clicked — and the status reflects the most recent thing they did.

Drilling into a single result

Per-result detail page showing the status pill, the Mark as Reported and Reset Status buttons, the metadata grid, and the simulated-email preview pane

Click any row in the list. The detail page shows:

The current status as a pill in the top-right.
Subject, From, Category, Sent, Status At in a grid — same data as the list row, formatted for reading.
Defensive behavior tested — the habit this test was built around (go direct, verify the sender, verify out-of-band, or skip unexpected attachments). Shown when the test is tagged with a behavior; absent for untagged tests. A small Uses urgency badge appears alongside it when the test leans on time pressure. See behavior-based remediation.
Sender pretext — what kind of sender the test was impersonating (a service notification, an executive, an IT request, and so on). Shown when tagged.
Language sent — Spanish or French (Canadian) when the user received a translated version. Absent when the test was sent in English.
IP Address and User Agent — the network address and browser behind the activity we recorded; on a Clicked result, the click. Absent when we didn’t record them. Use them to tell whether a click came from the user’s own device or from something else, such as an email security scanner. See A user got a click reminder but says they didn’t click for what to look for.
Simulated Email preview — the exact email the user saw (From/To/Subject + the rendered body). Helps you understand what they were looking at when they made their decision.

Correct a result

Sometimes a result doesn’t match what the user actually did. They reported the test with a tool we can’t see, or a security scanner opened the link before they ever saw the email. Two buttons at the top right of the result page, next to the status pill, let you fix it: Mark as Reported and Reset Status.

Both are for admins with the Administrator role, at any access level. Training Manager and View Only admins don’t see them. Each one changes only the result you’re looking at — it doesn’t un-send the test or change anything for other users.

Mark as Reported

Use Mark as Reported when the user reported the test, just not with our Report Phishing button — so the report never reached us. Common cases:

They used another vendor’s report button, such as Barracuda’s.
They used Outlook’s or Gmail’s built-in report option, where our button doesn’t take its place.
They forwarded the email to IT, the helpdesk, or a security mailbox, or called about it.
A scanner registered a click before the user reported the test with our button. A click outranks a later report, so the result stayed Clicked.

The button appears on any result that isn’t already Reported. Click it and the result becomes Reported, with a Marked as Reported confirmation next to the buttons. It counts as a report — the success state — the same as a report made with our button. A click on the result stops counting. The user isn’t notified.

A result you mark as Reported stays Reported, even if the link is opened again later.

Reset Status

Use Reset Status when the user didn’t do what the result says and didn’t report it either:

An email security scanner opened the link before the user saw the email, and the user ignored or deleted it.
A click that wasn’t really the user’s — a curious admin checking the test, for example.
You marked the wrong result as Reported and want to undo it.

The button appears on results that are Clicked, Credentials Submitted, Attachment Opened, or Reported. Click it and the result goes back to Opened, with a Reset to Opened confirmation. Opened isn’t a failure, so the click no longer counts against the user. If the link is clicked again later, the result can turn Clicked again.

What a correction changes

Required behavior training. If the click added a required behavior course that the user hasn’t finished, either button withdraws it, and Required training removed appears next to the buttons. The course stays if the user already completed it, or if another failed test that the same course covers still stands. If you see Status saved, but removing the required training failed. Try again., the new status saved but the course is still assigned; click the same button again to finish.
The day-after reminder. If it already went out, it can’t be taken back.
Risk score and reports. A corrected click stops counting as a click, and a result marked Reported counts as a report. On a Credentials Submitted or Attachment Opened result, the credential submission or attachment open still counts in the user’s risk score and in phishing reports after a correction. Contact our support team if that event wasn’t the user’s.

A user got a click reminder but says they didn’t click covers checking a disputed click and keeping it from happening again.

You’ll know what you’re looking at when

The counter matches your filter selection (try Clicked + Last 30 days to verify).
Click into a single row and you see the original email rendered in the preview pane.
A user’s risk score on the parent Risk page reflects the activity you see here.

Frequently asked

Why is a user showing as Reported on a test they shouldn’t have known was a test? That’s expected — the user recognized the email as suspicious and clicked the Report Phishing button. They weren’t supposed to know it was a test; they were supposed to handle it correctly, and reporting is the correct handling. The Reported status is the success state.

The status reads Sent but the test was sent days ago. Is something wrong? Sent means delivered but the user hasn’t interacted with it — they haven’t opened, clicked, or reported. Either it’s still sitting in their inbox or (more often) they’ve ignored it. Some users genuinely never read their email; others may have filed it as junk. Sent itself isn’t bad data; the user just hasn’t engaged.

A user got a click reminder but says they didn’t click, or that they reported the email another way. Usually one of two things happened: a security scanner opened the link, or the user reported the test with a tool we can’t see. Check the result’s IP address and user agent, then correct it with Mark as Reported or Reset Status. A user got a click reminder but says they didn’t click walks through it.

I don’t see Mark as Reported or Reset Status on a result. Both buttons are only shown to admins with the Administrator role. If you are one, check the status: Mark as Reported is hidden on a result that’s already Reported, and Reset Status only appears on Clicked, Credentials Submitted, Attachment Opened, and Reported results.

Where do I see what an individual user did across all their tests? Risk → User, click the user, scroll to their phishing history. That’s the per-user feed (same drilldown links into individual results). The Activity page is for the client-wide view; the user page is for one person’s history.

I just sent an on-demand test and it’s not showing up. It takes a moment for the send to flow through. Refresh the page after a minute. If it still doesn’t appear, the recipients may have been skipped — see Send a phishing test on demand for the skip rules.

Can I export this data? Yes. Export to Excel at the top right downloads every test matching your current filters, not just the rows on screen. A very large export is capped, most recent first; we tell you when that happens, so you can narrow the date range or filters and export the rest. To share results with a client on a schedule, use Scheduled reports or Custom reports.

Where do I see behavior breakdowns across all my clients? Settings → Phishing has cross-client cards for behavior coverage, remediation completion, urgency exploitation, and sender pretext. See behavior-based remediation for what each card shows.

Phishing templates — choose which tests are eligible for the client.
Behavior-based remediation — what the Defensive behavior tested field on a result detail page is tied to.
Send a phishing test on demand — when you need to push a specific test outside the rotation.
Report Phishing button — the user-side action that lands a test on the Reported success state.
A user got a click reminder but says they didn’t click — check a disputed click and correct the result.