Use real coworker names on phishing tests

Some phishing tests pretend to come from someone inside your client’s company: the CEO asking for an urgent wire, HR handing out gift cards, IT asking someone to renew their VPN, a coworker sharing a document. By default those tests use a made-up name. A real attacker would use the real CEO’s name, so you can have our tests do the same.

With Real names by role on, those tests show a real person from the client’s directory who has the matching role: one of the client’s executives, someone in HR, someone in IT. A coworker test comes from the user’s own manager when we know who that is, and otherwise from someone in their department. The name is real, but the address never is: every test still comes from a look-alike address, never the person’s actual mailbox, so checking the sender’s address still catches it. Tests sent from a free email address (Gmail, Outlook.com and the like) keep their made-up name, since a real name only ever goes on a look-alike address.

You’ll need

The client’s agreement to show their staff’s real names, executives included, on phishing tests. You’ll confirm it when you turn this on.
A client synced from Microsoft 365 or Google Workspace. Job titles from the directory decide who has which role.

Turn it on

Open the setting. For every client, go to Settings → Phishing and find Sender Names. For one client, open the client, go to Tailor → Phishing and find Sender Names. A client left on Use the organization setting follows your partner setting.
Choose Real names by role.
Tick the confirmation that the client has agreed. We record who confirmed it and when.
Click Save.
Check the roles. Go to Settings → Phishing → Job Titles and Roles and tick Only titles with no special role. For each title that should be an executive, HR or IT (for example “Owner” or “CEO/CFO”), pick the role. It applies right away to everyone with that title at every client, and keeps applying after every sync.

You’ll know it worked when

Sender Names shows Real names by role after you reload the page.
The next phishing tests that pretend to be a person show a coworker’s name.
Opening one of those results on a user’s page shows Impersonated coworker with the person’s name, and the email preview shows the name the user saw.

Frequently asked

Which tests use a real name? Only tests that pretend to be a person on the client’s own staff. Tests from a department or a service (“IT Service Desk”, “Mail Administrator”, a document-sharing portal) keep their names, and so do tests that pretend to be a vendor, a customer or a brand. The sender shows as the person’s name only, never with a job title, so nobody is given a title they don’t have. If the user clicks, the page they land on names the same person.

What if the client has nobody with the right role? The test goes out with its made-up name, as it does today. Nothing fails and nothing is skipped.

Can a user get a test that looks like it came from them? No. A user is never shown as the sender of their own test.

How do I keep someone out of this? Open the user from the client’s risk page and tick Don’t use as phishing sender. To do several people at once, go to the client’s People page, select them (filter by role to pick, say, every executive), and click Exclude as sender. Either way it applies within a minute and stays on through every directory sync, whatever the person’s role.

What should the client tell their staff? Let the executives, HR and IT people know before you turn this on. Staff who get a test with their name may ask them about it (“did you really need gift cards?”), and that’s a good moment for them to confirm it was a test and praise whoever checked.

Will the client’s email security catch these tests? It may. Some email security tools watch for an executive’s name on an outside address and move or remove the email after it arrives. If tests start disappearing, see An email security tool is removing phishing tests from inboxes.

What does our verification page show for these tests? If a user checks one of these tests on our verification page, the sender shows as “a coworker’s name”. The page never says who was used.

The client’s directory has no job titles. Can they still use this? Yes. Set each person’s role on their user page with Override next to their role. A role set on a user always wins over a title mapping. People with no special role are still used for coworker tests.

Can one client map a title differently? Yes. Use Job Titles and Roles on that client’s Tailor → Phishing page. A mapping there overrides yours for that client only.

Do title mappings change anything else? Roles also weigh into each user’s risk score, so a corrected title makes the score more accurate too.

What happens to past results if I exclude someone? Past results keep showing who they used. Excluding someone only stops them being used from then on.