Reports & Analytics

PhishSpot provides several ways to analyze your campaign results and track your organization’s security posture over time.

11.1 Campaign reports

Open a campaign and choose Filter and view report. The filters work like recipient selection: choose several departments, job titles, locations, risk levels or contact groups. A person matches any selected value within a category and must match every category you use. Clear category removes that category’s selections; Clear filters resets the whole selection.

Report filters only search people targeted by the selected campaign. They update the recipient table, totals and charts together. Exports use the same selection, including replies and quiz results. Departments, titles, locations and groups reflect the contact’s current details.

Use Group by to split the report by department, job title, location or contact group. Each section has its own statistics and recipient list. Contacts without a value appear under Unassigned. Someone in several contact groups appears in each relevant section, while their overall result is counted once.

Choose Download report, select a template and file format, then download. Available formats are PDF, DOCX, Markdown, RTF and CSV. PDF, DOCX and RTF include charts; Markdown includes numerical tables, and CSV contains participation rows for spreadsheet analysis.

The Clean template omits report logos. Cyberbezpieczny Samorząd retains the existing branding and is selected by default. Additional templates may be available for your organization.

For an anonymized download, select the anonymous report option. Recipient names and email addresses are replaced with fictional identities, used consistently throughout the document. Reply transcripts, quiz answers and email/landing-page previews are omitted from this version.

Understanding the result charts

Before the recipient list, the report shows a pie chart with percentages and a bar chart with counts. Each successful delivery receives one outcome, with the following precedence:

Provided real data.
Submitted the form.
Clicked the link.
Recognized the phish.
Opened the email only.
No recorded reaction.

For example, someone who clicked and then submitted the form is counted under Submitted the form, rather than in both categories. Training completion and replies are shown separately.

Percentages use successful deliveries as the denominator. Failed and unsent deliveries appear separately. Sending the same scenario to the same person again does not add another participation. The campaign details include the email subject and landing domain; separate template, landing-page and course data sections have been removed.

11.2 Combined and account reports

On the campaigns list, choose Umbrella campaigns to combine selected scenarios for reporting. Create a named umbrella campaign, select its scenarios and save. You can edit its name and membership later, or delete the umbrella while keeping the scenarios and their results.

Every scenario in an umbrella must use exactly the same post-click action and settings. A scenario can belong to one umbrella at a time. To change its action or move it to another umbrella, detach it first. Any user who can manage campaigns can manage these collections.

An umbrella report lists scenarios in creation order with a number beside each. The recipient table includes a Scenario column with that number. Someone who received two scenarios has two participation rows. Each row contributes once to the overall statistics.

The report link on the campaigns list covers all campaigns in the account. Both account and umbrella reports support the same filters, grouping and export choices as an individual campaign report.

11.3 Trend Dashboard

Navigate to Trends from the sidebar to access the trend dashboard. This view shows historical performance data across all your campaigns with date range filtering options: 30 days, 90 days, 6 months, 1 year, all time, or a custom date range.

The trend dashboard helps you answer questions like: Are employees getting better at recognizing phishing emails over time? Which departments need additional training? Is the click rate decreasing campaign over campaign?

11.4 Recipient Timeline

A click is recorded when the campaign page becomes visible in a browser and confirms the visit, or when its form is submitted. Simply fetching a link no longer counts as a click. This reduces false results from automatic link checks, though tools that run a full browser can still produce a visit. Blocking images can prevent an email-open measurement; blocking scripts can prevent a visit confirmation. A missing open measurement therefore does not prove that the message was unread.

Resetting a recipient invalidates the tracking links from their previous send. Opening an old message after a reset does not recreate its results or update a new send.

Within any campaign dashboard, clicking on a recipient opens a detailed timeline panel showing every tracked event for that person: when the email was sent, when it was opened, when the link was clicked, when the landing page was viewed, whether data was submitted, and whether the training course was started or completed.

11.5 Previewing the email each recipient received

Every row in a campaign’s Recipients table has a small magnifier-on-envelope icon next to the recipient’s email address. Click it to open a modal showing the exact email that contact received — with every template variable ({{first_name}}, {{company}}, {{position}} …) substituted with that contact’s actual values, the actual landing-page URL embedded, the actual From: address used. Not a generic preview: the rendered mail for that specific recipient.

The modal has a desktop / mobile viewport toggle at the top — flip between the two to see how the email looked on a 1920px-wide Outlook client vs. an iPhone Mail rendering. Useful during stakeholder review of a finished campaign (“show me exactly what Anna saw on her phone”) and during incident investigations (“did the link in this specific delivery target the right domain?”).

The same preview is also available from a contact’s individual deliverables view — open any contact’s detail page and the deliverable rows have the same magnifier. Two perspectives on the same modal: per-campaign (every recipient on one campaign) and per-contact (every campaign one person received).

Trend dates follow the first recorded send, with the scheduled date as fallback. Average click rates are weighted by recipient count. Direction compares separate early and recent campaign samples; fewer than two campaigns with sends have a neutral direction.

11.6 Period and final reports

From the account dashboard, open Period and final report. Choose a quarter, a contract year or another date range. The report compares it with the immediately preceding period of equal length, lists campaigns, shows quarterly history and compares current departments. Department comparisons are an internal benchmark, not an industry norm or a compliance grade. Consider sample size and scenario difficulty when interpreting changes.

Campaigns belong to the period of their first send. Outcomes show the state at generation time, including later reactions. Rates count each successfully reached campaign/recipient pair once; pending, bounced-only and excluded recipients do not increase the denominator. Training invitations are excluded from phishing indicators and combined phishing reports. Finishing a lesson does not imply that credentials were submitted.

Recorded reports include manual entries. Reports matched to a simulation counts messages correlated with an actual campaign delivery. Median reporting time runs from first send to first recorded report. Verified completions requires completion evidence and a certificate; a manual training flag does not count. Assessment pass rate uses the latest assessment for each assignment. A dash means no applicable sample.

Download PDF for review meetings, CSV for a spreadsheet, or JSON for processing. The report proposes follow-up training, communications and ISMS procedure reviews based on the results. Agree owners and deadlines during the quarterly review; recommendations do not change policies automatically. Use the whole contract period for the final report.

Administrators and editors can also download Handover ZIP: reports, account scenario HTML/CSS and visual projects, email attachments, course materials with answer keys, awareness pages and sequence rules. The archive excludes recipients, learner answers and integration credentials. Keep it private. Its README explains how to recreate the content and remap references in another account using the editor or API. Configure sending domains and audiences separately; this is not an automatic database restore. The archive has a 128 MB total source-content limit; download individual course files separately if needed.