Sophos Phish Threat: Calculating licensing and usage correctly
What matters is not the number of campaigns, but which unique users receive campaign emails. The combined licence report, billing boundaries, and …
Sophos Phish Threat
These guides help administrators license and set up Sophos Phish Threat, prepare reliable email delivery, run targeted campaigns and training, evaluate results, and meet governance requirements.
Contents
Sophos Phish Threat topic overview
The articles follow the administrative workflow: licensing and onboarding, delivery preparation, campaign design and targeting, training, user reporting, analysis, troubleshooting, and governance.
Licensing and usage 1
Understand licence consumption and calculate usage before rolling out simulations.
Getting started and onboarding 1
Verify user domains, prepare the environment, and follow the supported setup sequence.
Sophos Phish Threat: Getting started
Getting started with Sophos Phish Threat covers domain verification, email delivery, campaign creation, and evaluation.
Email delivery and allowlisting 5
Configure direct delivery, sender exceptions, Microsoft 365, and Google Workspace, and resolve delivery failures.
Sophos Phish Threat: Troubleshoot delivery failures and bounces
If Phish Threat emails are missing, check the campaign schedule and Bounced Mailboxes first. Then rule out recipient and synchronization errors, …
Set up Sophos Phish Threat Direct Delivery for Microsoft 365 and Google
A practical runbook for permissions, provider selection, activation, quick testing, Safe Links, troubleshooting, and rollback of API direct delivery.
Sophos Phish Threat: Allow senders, domains, and IPs
A secure allowlisting process for mail gateways, proxies, firewalls, and scanners—with dynamic Sophos values, validation, and rollback.
Deliver Sophos Phish Threat safely in Microsoft 365
This runbook distinguishes Graph-based direct delivery from the SMTP route and explains the Microsoft 365-specific permission, Defender, and routing …
Deliver Sophos Phish Threat securely in Google Workspace
This guide limits the Google Workspace exceptions to Sophos Phish Threat and shows setup, acceptance tests, troubleshooting, rollback, and regular …
Create and manage campaigns 2
Build, launch, monitor, and manage individual phishing simulation campaigns.
Sophos Phish Threat: Managing Campaigns
Campaigns are managed differently depending on their status. Drafts can be completed or discarded, while active campaigns can be paused and adjusted …
Create a Sophos Phish Threat campaign
Set up a single Phish Threat campaign from its objective, attack, and training through recipients, testing, scheduling, and validation.
Campaign series 1
Plan recurring simulations and operate campaign series safely.
Sophos Phish Threat: Create and Plan Campaign Series Safely
Campaign series automate recurring attack simulations or security training. Before launch, check the series type, domains, recipients, passing …
Campaign targeting and enrolment 1
Automatically enrol new users and keep campaign audiences current.
Sophos Phish Threat: automatically enroll new users
Automatic enrollment adds users created in Fusion in the future to a campaign or series. Their actual start depends on the campaign type and series …
Training and notifications 1
Configure training senders and the automated emails that accompany user training.
Sophos Phish Threat: Configure training sender and automatic emails
The training sender applies to automated training messages, not simulated attack emails. A verified domain, a successful test, and checks for the …
User reporting 1
Deploy and operate the Outlook add-in for reporting suspicious messages.
Sophos Phish Threat: Deploy and operate the Outlook add-in
From the target mailbox and SophosLabs setting through supported Outlook clients and Microsoft 365 assignment to reporting tests and migration from …
Results and reports 1
Review campaign outcomes, user responses, and available reports.
Evaluate Sophos Phish Threat results and reports
An administrative process for reliable metrics, delivery and user events, risk prioritization, CSV/PDF exports, follow-up actions, and data …
Reporting troubleshooting 1
Investigate missing images and open-tracking results that do not match expectations.
Sophos Phish Threat: Check missing images and Open Tracking
An Open is normally generated when the external 1×1 pixel is retrieved, but Sophos Phish Threat can also add one after a Click. An Open therefore …
Privacy and governance 1
Plan data protection, retention, access, and governance for phishing simulations.
Sophos Phish Threat: Data protection and governance
A governance runbook for approved Sophos Phish Threat campaigns, covering data minimization, clear responsibilities, restricted access to results, and …