Getting started with Fallax

Fallax sends realistic phishing simulations to your own team, shows people a short lesson the moment they fall for one, and keeps the evidence your auditors ask for. This guide takes you from an empty workspace to your first campaign.

1. Create your workspace

Sign in with your Google Workspace or Microsoft 365 work account. Fallax asks three quick questions, then asks you to name your workspace. A workspace is your organisation's own space: people, content, domains, campaigns and audit evidence live only there. Most teams use their company name.

If a colleague already runs Fallax for your company, you can ask to join their workspace instead. An owner or admin approves the request.

Keep one workspace per organisation. A second workspace splits your evidence trail in two, and neither half is the full picture at audit time.

2. Verify your domain

Open Domains. Fallax only sends simulations to addresses on domains you have proven you own. If you signed in with a work account, your own domain is usually verified already. Read Verify your domains for the details.

3. Connect Google Workspace or Microsoft 365

Go to Settings → Integrations and connect your mail platform. Fallax places simulations straight into your employees' inboxes, so there are no SPF, DKIM or DMARC records to publish and nothing to allowlist in your mail filter.

4. Bring in your people

Open People and click Sync directory. Choose everyone, or only certain groups or departments. Turn on daily sync so joiners and leavers are picked up on their own.

5. Send yourself a test

Every new workspace has an audience called Just me (test run) with only you in it. Use it for your first campaign to see exactly what your employees will get.

6. Launch a campaign, or let the Programme run

Open Campaigns and click New campaign: pick an audience, an email, what happens after the click, and when to send. If you would rather not plan campaigns at all, turn on the Programme. It tests each person on their own schedule and adapts the difficulty to how they do.

7. Follow the results

• Overview shows click, submission and report rates at a glance.

• Reported mail lists what people reported as suspicious.

• Standings ranks teams and people by how well they spot phishing.

• Reports gives you exportable evidence for audits such as ISO 27001, SOC 2 and NIS2.

Stuck at any step? Use the chat bubble in the app and we will help you out.