Autopilots

An autopilot runs a recurring phishing-awareness program for your contacts. Choose the audience and intensity, save, then click Start. PhishSpot prepares the content, schedules individual recipients and sends the simulations without requiring you to approve each campaign.

23.1 Creating a program

Open Autopilots → New autopilot. Give the program a name, choose All contacts or selected groups, and set the number of messages per person per day, week, month or year. Account defaults fill in the other settings. Saving creates a Draft; Start enables automatic sending.

First messages are spread over the coming delivery hours. Starting an existing program or resuming one does not send a backlog of missed simulations.

Advanced settings let you change:

• AI Optimizer: generates language-appropriate message variants and adapts topics and difficulty to previous responses. Enabled by default.
• Duration: continuous, or through a selected date in the account’s time zone.
• Industry, country and language: context for choosing scenarios and preparing the copy.
• Outcome after click: an awareness page, a training course, a chosen URL or no additional action. The awareness page is the default.
• Automatically include new members: include contacts added to the audience after the program starts. If disabled, the initial audience remains fixed. Disabled contacts and people removed from the selected groups are excluded in either mode.

Changes to program settings replace messages that have not yet been sent. Messages already accepted by the mail service retain their original content and outcome.

23.2 Content and learning

The program uses the published template library and AI-generated variants. Scenarios take account of language, industry and a broad role category derived from department or job title. Topics rotate to cover different types of phishing.

The objective is learning. A click or simulated data submission can lead to an easier follow-up on that topic. Two recent phishing reports without a click or submission allow the next exercise to become harder. A lack of clicks alone is not treated as proof that someone recognised phishing.

With AI Optimizer disabled, the program still schedules and sends automatically, using suitable library templates without generating AI variants or adapting difficulty to responses.

If AI is temporarily unavailable, PhishSpot tries a validated template in the selected language and topic. If none is available, affected messages wait and the program checks again automatically. It never silently switches to a different language.

23.3 Timing and limits

Intensity is a target cadence per person, such as 1 per month or 2 per week. Messages are distributed over time rather than sent to everyone simultaneously.

All autopilots on the same account share a limit of two messages per contact per local calendar day, with at least four hours between them. Overlapping groups or programs do not multiply this allowance. Delivery follows the account’s configured days, hours and time zone, including daylight-saving changes.

Narrow delivery windows, overlapping programs or temporary service interruptions may reduce the achieved cadence. The system defers messages instead of exceeding the limit or catching up in a burst. Use one-off campaigns when you need a specific send time and exact copy.

23.4 Checking activity

Open Activity and delivery on a program. You can see its active participants, next planned send, last accepted send and recent delivery history. Each message shows its topic, difficulty, selection reason and a link to its campaign.

• Scheduled: waiting for its send time and validated content.
• Accepted for sending: the mail service accepted the message; this does not yet confirm delivery.
• Delivery confirmed: the mail service confirmed delivery to the recipient’s server.
• Awaiting confirmation: the request’s outcome is uncertain. PhishSpot waits for confirmation instead of risking a duplicate send.
• Failed / Skipped: the service rejected the message, or the recipient no longer qualified.

A waiting program displays the missing requirement, such as a sending domain, active recipients or suitable content. Account administrators who receive alerts are notified when intervention is needed. The program resumes automatically when a temporary requirement is restored. Campaign results remain available in Reports & Analytics.

23.5 Pause, resume and stop

Pause prevents new sends, including queued work. A message already accepted by the mail service cannot be recalled. Start resumes a paused program with a new future schedule.

Stop permanently ends the program. It cannot be edited or restarted; its history remains available. Stopping requires confirmation. To run another program, create a new one. You must stop a running or paused program before deleting it; deletion removes its program history but retains its campaigns.

Programs with an end date stop automatically after that date. Programs already marked Running begin using the automatic schedule without sending historical catch-up messages.

23.6 Default settings

The gear menu’s Autopilot settings sets the starting industry, country, language, post-click outcome and intensity for new programs. Changing these defaults does not overwrite settings already saved on existing programs.

Related guides: Contacts, Groups, Courses, Directory sync, API and MCP.