Question 1

Getting Started: How to set up AutoPhish for your Company

Accepted Answer

After you have created your AutoPhish account (see "How to create an AutoPhish Account"), the Dashboard guides you through a short Get started checklist. This article walks you through every step.

The Get started checklist

The checklist on the Dashboard shows your progress ("… of … steps complete"). Each step unlocks the next one:

Set Up Your Company
Verify Your Domain
Select a Subscription Plan
Create Your First Target List
Create Your First Campaign
Report a Phishing Email

After you have verified a domain, the checklist also offers Start security monitoring. This step is optional and does not block the others.

Step 1 – Set up your company

Click Go to Company Setup and fill in:

Company Name, Company Website and CEO Name – AutoPhish uses these to make simulations realistic.
Email Address for Domain Verification – an address on your company's own domain, for example admin@yourcompany.com.
Optionally your Company Address and Company Logo (JPG, PNG, GIF or WEBP, max. 3 MB) and your Primary, Accent and Background colours. Simulated messages and training pages use your logo and colours.
Anonymous Mode – enables pseudonymised reporting. Once enabled, you cannot switch it off yourself; see "How to enable Anonymous Mode".

Accept the legal documents on behalf of the company and click Complete Setup. AutoPhish now analyses your website to tailor future simulations –

Question 2

Create and Manage Target Lists (incl. CSV Import)

Accepted Answer

Target lists are reusable groups of recipients for your simulations. You create a list once, keep it up to date, and select it in every campaign – for e-mail, SMS and QR code simulations alike.

Where to find it

Click Phishing in the top navigation, then Lists in the sidebar. The page shows all lists of the company you have selected in the header, with the number of targets and the campaigns that use each list.

Lists page in AutoPhish

Step 1 – Create a list

Under Create a new list, enter a List name (for example "All Staff" or "Finance").
Optionally add a Context, e.g. "Accounting team, works with invoices and payment runs". AutoPhish uses this context to tailor generated messages to the group.
Click Create, then Open to go to the list.

You can add or change the context later in the List Context card on the list page (Edit → Save Context).

Step 2 – Add targets

On the list page you have two options.

Add a single target: Fill in First name, Last name, Email and optionally Phone number, then click Add target.

Import a CSV file: Under Bulk actions, click Choose CSV or drag here and select your file. Click Download example CSV to get a template.

![Add targets manually or import a CSV file](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/list

Question 3

How Credits Work – Costs, Balance and Buying More

Accepted Answer

AutoPhish uses credits for everything that is sent or scanned. All channels draw from one shared pool, so you can freely decide how much to spend on e-mail, SMS or QR code simulations.

What costs how much

| Action | Credits | | ---- | ---- | | Simulation e-mail | 1 per recipient | | Unique AI-generated e-mail per recipient | 2 per recipient | | SMS | 2 per SMS segment (160 characters, 70 with special characters) | | QR code by e-mail | 2 per delivered recipient | | Printed QR poster location | 10 once, when the location is saved | | Test e-mails to yourself | Free (up to 10 per hour) |

Security scans: one baseline scan per scan cadence of your plan is included. Additional scans and deeper scan types use credits.

Credits are only charged for successful deliveries. Failed or expired deliveries are refunded.

For the number of credits included in each plan, see https://autophish.io/pricing.

Where to see your balance

Go to Settings → Billing.

Overview shows Credits this period: how many included credits are left, how many were used and how many are reserved, plus a breakdown by e-mails, SMS segments and security scanning.
Credits shows included and purchased credits separately, credits reserved for queued work and your purchase history with invoices.
Usage shows which company spent how many credits on what, and can be exported as CSV. This is useful if you manage several companies under one subscription.

![Settings - Billing - Credits this

Question 4

Create and Launch a Campaign

Accepted Answer

Step-by-step guide to set up, review, and send your first phishing simulation.

This guide walks you through creating and launching a phishing simulation via the campaign wizard.

Heads-up: When you click Save and Start Campaign, AutoPhish sends messages to your targets immediately, or at the scheduled start time if you set one. Double-check recipients and obtain approvals first.

1) Start a new campaign

Sign in and go to your Dashboard.
Click + New Campaign in the header.

2) Choose Tone & Style

Enter a Campaign Name.
Choose the Delivery channel: Email, SMS or Quishing (QR code). For the details of each channel, see "Run an SMS Phishing (Smishing) Simulation" and "Run a QR Code (Quishing) Simulation – by E-Mail or as Printed Posters".
Choose a Tone (from very professional to very amicable).
Pick a Test Interval (e.g. one-time only, monthly).
Select a target list under Target Email Addresses. Use a list with test addresses first. See "Create and Manage Target Lists (incl. CSV Import)".

Click Next.

3) Select a Scenario

Choose who the e-mail appears to come from (internal, external or Auto).
Choose Auto (recommended) to let AutoPhish pick a fitting scenario for each e-mail, or Choose specific scenarios, expand a category (e.g. Social Engineering, IT Support, HR) and select the scenarios you want.
Click Next.

4) Generate the Email

AutoPhish generates a tailored phishing e-mail (From

Question 5

Manage Users, Roles & Multi‑Company

Accepted Answer

Manage Users, Roles & Multi-Company Access

Invite teammates, manage company roles, transfer ownership, and switch between companies in AutoPhish.

AutoPhish lets teams work together inside one company account, while also supporting multi-company access for consultants, MSPs, and organizations that manage several separate environments. Each company has its own members, campaigns, reports, settings, and audit data. If a user belongs to multiple companies, they can switch between them, but data remains isolated per company.

Who can manage users

User management is available from the company settings area.

Go to: Settings → Manage Companies → Team

From there, authorized users can view team members, invite new users, resend pending invitations, remove members, and transfer company ownership.

Understand roles

AutoPhish uses company-level roles to decide what a user can do inside a specific company.

Owner

The Owner is the primary administrator for a company.

Owners can:

Manage team members
Invite Admins and Users
Remove non-owner members
Transfer ownership to another Admin
Manage company settings and billing-related ownership responsibilities

A company can only have one Owner. The Owner cannot be removed until ownership is transferred to another Admin.

Admin

Admins can manage most company operations.

Admins can:

Manage campaigns
Invite teammates
Remove non-owner members
View reports and company data
Manage company settings availabl

Question 6

Quotas, Scheduling and Randomized Send ("Sprinkle")

Accepted Answer

Credits

Every plan includes a number of credits per billing period. All channels draw from this one shared pool: a simulation e-mail costs 1 credit, an SMS segment 2 credits, and a QR code sent by e-mail 2 credits. When your credits are used up, AutoPhish stops sending until you buy more credits or your next billing period starts – unless your contract includes paid overage. For details see "How Credits Work – Costs, Balance and Buying More" and https://autophish.io/pricing.

Scheduling

In the first step of the campaign wizard, choose a Test Interval: One-time only, Monthly, Quarterly, Half-yearly or Yearly. Recurring campaigns run automatically on their cadence until you pause them or your credits run out.

Schedule campaign – set a start date and time. Leave it blank to start immediately when the campaign is activated.
Require admin approval before each run – for recurring campaigns, admins receive a preview e-mail and must approve before the campaign sends to recipients.

Randomized delivery ("Sprinkle")

To avoid everyone receiving the test at the same moment, turn on Sprinkle Campaign (send over time) and set the Sprinkle window (days). Each recipient then receives the message at a random time within that window, so results better reflect real-world conditions. Sprinkle is available on the Professional and Enterprise plans.

Tips

Start with monthly tests, then adjust the frequency as your programme matures.
Spread deliveries ove

Featured & Frequently Read Articles

Browse All Categories