The last thing you want is a missed step or configuration problem stopping you in your tracks.
This checklist covers everything you need to tick off before going live. Some steps are optional depending on your setup.
​

​

Allow listing is the foundation of successful phishing simulation delivery.

How you configure it depends on your infrastructure and security tooling.

Read our detailed allow listing guide for full instructions.

Exchange connector
Configure an Exchange connector if this is your preferred method, it is ours!
Read more here.
You can also simply allow list our IPs and links in all your email tooling.
​

Defender advanced delivery
Add our IPs to the Advanced delivery page in Microsoft Defender.
This is essential for Microsoft 365 customers and tells Defender to trust our simulation emails.
​

Safe links policy
Add our links as exceptions to your Safe links policy.
Without this, Microsoft may rewrite our URLs, which breaks click tracking.
​

Anti-phishing policy
Make sure any anti-phishing policies don't block our emails.
Check for impersonation protection rules that might flag our sender domains.
​

If you use Mimecast, you'll need to configure several exceptions:

Each of these is critical. Missing even one can cause delivery failures or tracking problems.
​

Add our IPs as exceptions in Google Workspace's spam, phishing, and malware configuration. Google handles allow listing differently from Microsoft, so make sure you follow our Google-specific guide.

If you use Proofpoint, you'll need to configure several exceptions:

Proofpoint's configuration interface varies between Proofpoint Essentials and Proofpoint Enterprise, so the exact steps depend on which version you use.
Consult Proofpoint's documentation for your specific setup.
​

Add our link domains to any safe link or URL inspection policy exceptions:

This is crucial. Network devices, proxies, and email security tools often inspect links automatically. Without these exceptions, those inspections register as clicks in your reports, creating false positives.
You'll see "clicks" from people who never actually clicked anything.
​

If you're seeing multiple clicks happening at exactly the same time, or clicks registering within seconds of email delivery, link inspection is almost certainly the cause. You can obtain the IP address registered for the click from the Phishing report > Activity Log to identify which tool within your infrastructure requires further allowlisting.
​

Important: Microsoft and Google require different email delivery configurations. Make sure your CybSafe platform settings match your email provider.
Microsoft 365 customers should use the "Default" configuration, while Google customers need "Expanded domains".
Check our platform settings guide for details.

We strongly recommend connecting your existing phishing report button to CybSafe. This captures simulation reporting behaviour and gives you accurate data on how your people respond to suspicious emails.

Without this integration, you'll only see who clicked or submitted data. You won't know who correctly identified and reported the simulation.
Reporting behaviour is arguably the most valuable metric for measuring security awareness.
​

Configure your report button to forward reported emails to CybSafe. The setup process varies depending on whether you use:

Read our report button integration guide for step-by-step instructions.
​

If your organisation uses Outlook desktop, be aware that some people may have "Classic mode" enabled. This setting buries third-party report buttons in the interface, making them hard to find.
People in Classic mode often don't report suspicious emails simply because they can't locate the button.

If you're seeing lower-than-expected report rates from certain groups, this could be the cause.
You might need to communicate where to find the report button for people using Classic mode, or work with your IT team to standardise Outlook settings.
​

Don't skip this step. After configuring the integration:

Before involving anyone else, run a test campaign to your own email address. This confirms that allow listing is working and emails are being delivered.
​

​

Send yourself a simulation email and check each stage:

You can track email status in the Phishing activity log.
Note that this report can take up to an hour to refresh, so don't worry if events don't appear immediately.

Once you've confirmed test emails are being delivered clicked and interacted with, click "Mark as complete" on the CybSafe IP settings banner on the PHISH page.
​
Without completing this step, phishing emails won't be sent when you create campaigns. This is a common oversight that catches people out.

Before rolling out to your whole organisation, run a pilot campaign to a small group of people.
This catches any delivery issues that might not affect your admin account.

Pick a diverse group that represents your organisation:

This variety helps you catch edge cases. Some delivery issues only affect specific configurations or a locations unique infrastructure
​

Create a normal campaign, but limit the audience to your pilot group. You can do this by:

You can create custom phishing email templates to match your organisation's context.
Custom templates can reference internal systems, brand names, or topical events that make simulations more realistic.

Custom landing pages let you control what people see after clicking a simulation link. You might include a specific example of a page your organisation's typically uses.
We recommend making it really obvious it is a fake!

Custom intervention pages appear to people who interact with simulations. These are your opportunity to turn a "gotcha" moment into a learning moment.

Note: Only one intervention page can be active on your account at a time.

Make sure you enable the right one before launching.

Before launching, think about how (and whether) you'll communicate with your people about phishing simulations.

This depends on your organisation's culture and goals.
Some organisations prefer surprise simulations to get "realistic" data.
But research shows this approach can backfire, creating distrust and anxiety rather than better security behaviour.
​

CybSafe recommends being transparent.
Let people know simulations are part of your security programme.
You don't need to announce specific timing, but being upfront about the purpose helps:

If you do communicate, consider covering:

Keep the tone supportive. The goal is building a culture where people feel comfortable reporting suspicious emails and admitting mistakes.

Every organisation's setup is different, but here are our tips:

Sometimes emails don't arrive as expected, even with correct allow listing.
Here's what to check.
​

If simulation emails are taking a long time to arrive (or not arriving at all), several things could be happening:
​

Check your allow listing first.
Most delivery problems come back to incomplete allow listing. Double-check every policy and tool in your environment.
​

Large campaign volumes. Sending to thousands of people at once can trigger throttling with your mail server.
Consider spreading large campaigns over multiple days or times.
​

If you've verified your allow listing and emails still aren't arriving:

We can help investigate and provide additional information to help your internal troubleshooting.

Why are emails showing as opened when people haven't opened them?
This usually means a security tool is scanning emails before they reach inboxes. The scanning triggers our tracking as an "open".
Check your allow listing configuration, particularly for tools like Mimecast, Proofpoint, or Defender that scan email content.
​

Why do I see clicks and credential submissions at the exact same time?
Security tools sometimes "click" links and even submit test data to landing pages as part of their scanning. If you see multiple events happening simultaneously, it's almost certainly automated scanning rather than human behaviour.
Make sure you've allow listed our domains in all your security tools.

How long does it take for the activity log to update?
The Phishing activity log can take up to an hour to refresh.
If you've just sent a test campaign, give it some time before troubleshooting.
​

What if my test emails are going to spam or quarantine?
This means your allow listing isn't configured correctly.
Check that you've added our IPs and domains to all relevant policies in your email security tools.
Microsoft 365 customers should make sure they've configured the Advanced delivery page in Defender.

Can I send simulations to people on personal email addresses?
We don't recommend this. Simulations should only go to corporate email addresses where you have appropriate allow listing configured. Sending to personal addresses (like Gmail or Yahoo) will likely result in emails being blocked or marked as spam.
​

What happens if someone forwards a simulation email?
If someone forwards a simulation to another person or to a shared mailbox, any interaction with that forwarded email gets recorded against the original recipient.
This creates inaccurate data. Encourage people to use the report button rather than forwarding suspicious emails.
​

Why isn't my report button integration working?
First, check you've configured it correctly by following our integration guide.
Check that your mail flow rules are configured correctly and that you're using the right report button (Microsoft's built-in button vs add-ins have different configurations).
The priority of the rule and any rules that run before may impact the reporting rule. Check the priority and also check for any other rules that stop processing rules.
​

Can I run campaigns during specific times only?
Yes. When creating a campaign, you can set operating hours to control when emails are sent.
CybSafe will also respect individual time zones if you've imported this data from your identity provider.
​

My emails are being delayed by hours. What's happening?
Email providers like Microsoft sometimes throttle connections, which delays delivery. This can happen even with correct allow listing if the volume of incoming emails is large.
If delays are significant (more than a few hours), contact CybSafe support so we can investigate on our end.
​

Should I tell people we're running simulations?
We recommend being transparent. Let people know simulations are part of your security programme without announcing specific timing.
This builds trust and frames simulations as learning opportunities rather than tricks.