This guide takes you from your first login to a fully automated simulation playlist in six steps. Work through them in order: later steps depend on earlier ones.
Step | What it does | Who is involved |
Before you begin | Admin access, single sign-on, and inviting your other admins | Platform admin |
1. Integrate employee data | Decides who receives simulations and training | Identity / directory admin |
2. Ensure deliverability | Gets simulation emails and landing pages through | Email / security admin |
3. Set up the reporting path | Lets employees report suspicious mail in one click | Email / security admin |
4. Add company context | Makes simulations realistic and relevant | Security awareness |
5. Run your first campaign | Proves the setup with a small test group | Security awareness |
6. Activate the automated playlist | Runs simulations continuously and risk-based | Security awareness |
💡 Tip
Steps 1 to 3 are technical and sit with your IT, identity, and email admins. Steps 4 to 6 sit with whoever runs security awareness. Lining those two groups up early is the single best way to avoid delay.
Before you begin
revel8 sends your admin credentials by email. Use them to set a password and log in for the first time.
📝 Note
No email? Check your spam folder and your email quarantine, or ask your revel8 contact to send it again.
Everything below sits under Settings → Access Controls. You can invite the rest of your admins yourself, with no IT ticket required.
Single Sign-On (recommended): connect SAML via Microsoft Entra ID or Google Workspace.
Password policy and 2FA: see Access Controls: Password Policy & Two Factor Authentication.
Users and roles: invite your other admins and assign what each of them can do. See Manage User Access & Roles.
💡 Single Sign-On is the recommended path
You can add SSO at any time, so it never blocks your rollout, but setting it up early means nobody manages a separate revel8 password.
1. Integrate employee data
This decides who receives simulations and training, so start here. Configure it under Settings → Employee Sync, then pick the option that matches your environment.
💡 Tip
Automated provisioning via SCIM or LDAP is the recommended option. It needs almost no maintenance: joiners, leavers, and attribute changes are picked up automatically.
Microsoft 365 / Entra ID: Microsoft Entra ID Sync via SCIM. Keeps employees in sync automatically as people join and leave.
Google Workspace: Google Workplace Sync via LDAP. Syncs users and groups.
On-premises directories, or as a fallback: User Upload via CSV or Excel File. Use this where automated provisioning is not available. Membership does not update on its own, so you re-upload as people join and leave.
📝 Note
You are done with this step when your employees appear under Organization → Employees.
2. Ensure deliverability
There are two parts to this, and both matter: simulation emails need to reach the inbox, and the landing pages they link to need to open.
2.1 Get the emails delivered
Choose whichever approach fits your environment. Whitelisting and Direct Message Ingestion are alternatives, so you only need one.
Your mail environment | Whitelisting | Direct Message Ingestion |
Microsoft Defender | ||
Google Workspace | ||
Proofpoint or another gateway | Not available |
Using a gateway that is not listed? The principle is the same: allow the revel8 sending domains before the filter reaches the mailbox. Reach out to revel8 if you want help getting it configured.
Whitelisting or DMI: which should I choose?
Whitelisting or DMI: which should I choose?
Both get simulations to the inbox. Whitelisting tells your mail filter to let revel8 emails through, so the mail travels the normal path and exercises your real filtering chain, but it needs a change in Defender or Google Workspace and a later policy change or migration can undo it. Direct Message Ingestion (DMI) places the simulation straight into the mailbox and bypasses filtering entirely, so there is nothing to whitelist and nothing to break later, but it does not test your filters. Choose whitelisting if your security team wants the filtering chain exercised, DMI if you want the lowest-maintenance setup.
2.2 Allow the landing page URLs (Fake Websites)
Simulations link to revel8-hosted pages, which many setups block by default. See Outbound URL Whitelisting in Microsoft Defender for Endpoint. If you use a different endpoint or web filter, apply the same allowlist there.
⚠️ Warning
Outbound URL whitelisting applies either way. It is a separate control from email delivery, so it is still needed whether you chose whitelisting or DMI, and it is the step most often missed: the email arrives, but the landing page will not open.
A test simulation did not arrive
A few things to check, in this order:
Quarantine: was the message held rather than dropped?
Whitelisting scope: does the rule cover the sending domain and the landing-page URL, rather than only one of them?
A recent migration: whitelisting often does not survive an Exchange or gateway migration.
This is the step most likely to need a second pass, so confirm it before anyone outside your test group is in scope.
3. Set up the reporting path
This gives employees a one-click way to report suspicious mail and routes real reports to your security team.
Your environment | What to set up |
Microsoft 365 / Exchange Online | |
Exchange on-premises | revel8 Reporting Button for Outlook (Exchange on-premises). Needs to be enabled for your organization, so contact revel8 before you start. |
Google Workspace | A reporting button for Gmail is available. There is no setup guide for it yet, so reach out to revel8 and we will walk you through it. |
Mobile reporting |
What happens when someone reports an email?
What happens when someone reports an email?
Two separate paths, and the difference matters for your logging. A revel8 simulation shows the employee an instant confirmation, and only the report event reaches the revel8 platform. Any other email is forwarded to the mailbox you configured and does not reach revel8 at all, so your own mail-flow logs are the source of truth for real reports.
4. Add company context
Context is what makes a simulation convincing. The more revel8 knows about how your company actually communicates, the more realistic the simulations. Maintain it under Organization → Context collector:
Configure manual context: your tools and industries, plus the tone simulations use.
OSINT-based AI Generated Context: let revel8 gather public information about your company automatically.
Manage Company Email Signature: match your real signature format.
Add and Manage Voice Clones: for voice phishing simulations.
5. Run your first campaign
Start with a small, friendly test group, usually IT and security. This proves the whole chain end to end before anyone else sees a simulation.
⚠️ Warning
Creating a campaign does not start it. It stays idle until you open the three-dots menu on the campaign row and choose Schedule.
6. Activate the automated playlist
Switch from one-off campaigns to a continuous, risk-based playlist that keeps training people automatically based on how they behave. See Scheduling: Defining Parameters for Automatic Playlist Scheduling.
Open Human Risk Monitor → Playlist, then click Manage Playlist to choose the channels and the simulations to include. Save your selection, then click Start to activate the playlist.