Automated spear phishing
Automated spear phishing campaigns automatically assign personalized phishing scenarios to each employee based on their job title, department, and the vendors your company uses, so you no longer have to create multiple campaigns and select scenarios manually to target employees. Engineers get GitHub-themed scenarios, Finance gets payment-themed ones, and so on.
Creating a spear phishing campaign
Go to Campaigns > click Create campaign > Select Automated spear phishing from the dropdown.
Choose the campaign name and employees to include.
Review your vendor list. Adaptive pre-populates this from your preferred vendor settings, but you can add or remove vendors during campaign creation. The campaign will only use vendors from this list, so the more you include, the more personalized they will get.
Review other senders. Adaptive automatically includes BEC impersonations and external senders (e.g. a candidate asking about the company), but these can be excluded.
Review the remediation, notification, and cadence settings as you would a normal campaign.
Review the campaign summary, where you can preview a sample of employees and the scenarios they might get.
Launch!
That's it — Adaptive handles the rest. You don't select individual scenarios; the platform maps each employee to the right ones automatically.
Previewing your campaign
Before launching, the review page contains a preview with a sample of employees and the types of scenarios they'll receive. You can also search for any specific employee in the campaign to see what they'd be assigned. This is meant to be an illustrative sample — it will give you an idea of the senders each employee is eligible for, but the exact scenarios they get might vary.
Use the preview to confirm that personalization looks right before the campaign goes live.
What employees receive
Scenario assignments are based on each employee's job title, department, and the vendors included in your campaign. Employees without role information will receive a mix of generic scenarios drawn from the full vendor pool you selected, plus internal (BEC) and external impersonations.
Viewing results
Once live, spear phishing campaigns appear alongside your other campaigns. For a given cycle (for example, a monthly campaign starting in June), you can see which employee was assigned which scenario throughout that period.
Reporting and remediation work the same as manual campaigns. If an employee fails a scenario, they'll receive a failure notification and remediation content as usual.
Data requirements
The more data you have, the more effective spear phishing will be, so we recommend updating your data or setting up a directory integration if you haven't already.
The two most important fields for spear phishing are job title and department. If you have fewer than 25 employees or limited data in these fields, spear phishing will not be able to run and the option will be disabled.
To improve your employee data, you have two options:
Option 1: Connect a directory integration
Syncing with your identity provider or HR system (Okta, Google Workspace, BambooHR, etc.) is the fastest way to get complete, up-to-date employee data. Once connected, Adaptive pulls job title, department, and other attributes automatically.
Option 2: Upload a CSV
If you're not using a directory integration, you can manually upload a CSV file with updated employee information, including job title and department.
Once you update your data, check back after a few hours. Automated spear phishing will become available once your data meets the required threshold.
FAQ
Are we creating brand new scenarios for each person?
Today we only assign scenarios from our existing library, but we are continuously adding more personalization with the goal of eventually generating customized scenarios.
How does automated spear phishing decide which vendors each employee gets?
We ingest each employee's attributes from your directory or CSV upload (role, department, job title), pass that through our AI model to get the vendors most relevant to that person, then map those vendors to scenarios in our library. You can also include simulations from retailers (e.g. food delivery, shopping, airlines) which get assigned to employees based on their location.
Can admins control what gets sent?
Yes. You choose the list of vendors we simulate, and you can exclude internal impersonations like the CEO or HR. Because this version of spear phishing only uses the existing library, there is no risk of a sensitive auto-generated scenario such as a fake bonus.
What happens on recurring campaigns?
Each employee is eligible for a set of scenarios relevant to them, and we randomly pick one they have not gotten before for each send. Recurring campaigns also pull in fresh scenarios that were added recently, so the content stays current and people are not repeating.
Can I run spear phishing using multichannel scenarios?
As of now, spear phishing is only available for email and we will gradually add more channels over time.