Skip to main content
AutoPhish runs email phishing simulations for you. You choose how often each person is tested, how hard the emails are and which topics are off limits. Cimento then writes a different email for each employee, schedules the sends and shows anyone who clicks what gave the email away. There are no campaigns or templates to build. AutoPhish is under Admin → Phishing → AutoPhish. If you don’t see it, ask your Cimento contact to turn it on for your organization.

​
Before you begin

  • Direct email delivery. AutoPhish places simulations directly in inboxes, so you need a connected and verified Google Workspace or Microsoft 365 integration. Turn it on stays disabled until one is ready, and the page links to Set up mailbox injection.
  • Your employee directory. AutoPhish tests everyone synced from your directory unless you exclude them.
  • A report button (recommended). Reports made with the Phish Alert Button count as Reported in AutoPhish results.

​
How a round works

  1. Each period (for example, every two weeks) AutoPhish opens a round for the people due a test.
  2. It writes one email per person. Emails are based on the person’s role and department, your company details and the vendors your team hears from. Some come from a familiar vendor, some look like a note from a colleague.
  3. The round opens two business days before its first send. In that time you can preview every email, flag anything that isn’t a fit, remove a person or skip the round. See Review and results.
  4. Sends are spread across the period, so colleagues don’t receive their emails at the same moment.
  5. Anyone who clicks gets short training that walks through the red flags in the email they clicked. Anyone who reports the email is counted as reported.
New joiners get their first test seven days after they join, instead of waiting for the next round. These rounds are marked New joiners on the Schedule view. After that, new joiners are tested on the normal schedule.

​
Set up AutoPhish

The AutoPhish setup page with frequency, review reminder, difficulty, sensitive topics and never use sections, and a Turn it on button

Admin › Phishing › AutoPhish › Turn it on

1

Add company details

Click Add company details. These details are optional but help AutoPhish write emails that fit your company. They are used only to write your simulations and are never shared.First, pick your industry, or click Add your industry to type your own.
The Tell us about your organization step, with industry options such as Technology / SaaS and Financial services

Add company details › pick your industry › Continue

Then pick the vendors your team gets email from. AutoPhish only imitates the vendors you pick. Click Add a sender for any that aren’t listed, then click Save.
The Who emails your team from the outside step, with vendors such as Microsoft, Google, Slack and DocuSign selected

Pick the vendors your team hears from, then click Save

2

Choose how often each person is tested

Weekly, Every 2 weeks, Monthly or Quarterly. The default is every two weeks.
3

Choose review reminders

Turn on Remind admins to review each round before it sends to get a reminder when a round is ready to review. Reminders go by Email, Slack or both. Slack needs the Slack integration.
4

Set the difficulty

5

Set sensitive topics

Move the Sensitive topics slider between Avoid and Use. Further toward Use, AutoPhish may write about higher-stakes subjects, such as legal or HR matters. The page suggests checking with HR before going above the middle of the scale.Never use lists topics AutoPhish will steer clear of. It fills in from the slider. Click + Add to add a topic, or the × on a topic to remove it. Your changes stay when you move the slider. Click Reset to go back to the suggested list.
6

Turn it on

Click Turn it on. AutoPhish writes the first round shortly afterwards, and no email goes out sooner than two business days later.If other phishing campaigns are still sending, AutoPhish offers to cancel them so employees don’t get simulations from both. Cancelling stops only what hasn’t been sent yet, and results so far are kept. You can also keep them running.

​
Change settings

Click the gear icon on the AutoPhish page to open Program settings. You can change review reminders, difficulty, sensitive topics, Never use and your company profile. Changes apply to rounds that haven’t been written yet.
The Program settings dialog with review reminders, difficulty, sensitive topics, never use and company profile

Gear icon › Program settings

To change how often people are tested, use the frequency menu next to Running on the Results view.

​
Choose who is tested

AutoPhish tests the whole company by default. Click Recipients to exclude whole teams with Exclude all, or search by name or email to exclude one person. Excluded people get no new simulations, and their past results are kept.
The Manage recipients dialog listing teams with Exclude all and Include all buttons, and a search box for excluded people

Recipients › Exclude all on a team, or search for one person

​
Pause AutoPhish

Click Pause. Everything already scheduled is cancelled and nothing goes out until you click Resume. Past results stay on the page.