BAIT runs your organisation's security-awareness programme. You send consented, approved phishing simulations to your own staff, and you see the results per group, never per person.
BAIT helps you collect evidence for your awareness programme. Every campaign is approved by a second person, goes only to email domains you have proved you own, and is reported per group.
What BAIT is, and what it is not
BAIT is:
a console for the few people who run your awareness programme;
a library of reviewed simulation emails, called scenarios, plus an editor to write your own;
a two-person approval process for every scenario you write and every campaign you send;
per-group reporting, with a board report you can download.
BAIT is not:
a tool for testing people outside your organisation. It sends only to addresses on domains you have proved you own;
a way to single out individuals. Results are per group. Identifying a person is a separate, audited request that needs your Data Protection Officer;
something your employees log in to. They only receive the simulated email.
Who uses it
BAIT keeps two groups of people apart.
The programme team signs in to BAIT. These are the few people who design, approve and report on campaigns, for example a security awareness lead, the CISO and someone from HR. Partner staff may also run BAIT for a customer.
Employees receive the simulations. They never use BAIT and are never named in it. See People and departments.
Programme team members have one of two roles:
Role
What they do in BAIT
Admin
Everything a User does, plus: set up the organisation, sending domains and directory; save and approve scenarios; use the Bait Assistant; configure a scenario's simulation web address; sync people; request an identity reveal.
User
Open every page; prepare campaigns and request approval; approve or send back someone else's campaign; pause and resume sending; export the board report.
Actions that only Admins may take are hidden from Users. Where a whole form is for Admins, Users see "Only administrators of this BAIT installation can do this." instead. If you need one of these actions, ask an Admin.
Two rules apply whatever your role:
Nobody approves their own work. A campaign needs a second person to approve it, and so does a scenario your organisation writes (scenarios are approved by an Admin).
You need at least two people on the programme team before you can send anything.
Before you begin
Your BAIT workspace has been created and you can sign in. See Single sign-on.
An Admin has completed Set up BAIT: organisation details, receiving domains, people and a Data Protection Officer.
Your Soveryne contact has set up the mail route that delivers your simulations. There is no screen for this in BAIT.
Getting around
The bar at the top of every page holds the navigation, the EN | NL language switch, the light and dark theme switch, the Settings button (the sliders icon) and your account menu.
The BAIT home page with items that need attention, the live campaign card, the resilience card and upcoming campaigns
Page
What it is for
Home
What needs your attention today, the campaign that is running, and what is coming up.
Campaigns
Every campaign, filtered by stage, and + New campaign. See Campaigns.
Marketplace
The library of scenarios: Soveryne's reviewed scenarios and your own. Opens the Scenario editor. See Scenarios.
People
Your employee groups, their size, and their latest campaign. See People and reports.
Reports
Results per group and per campaign, and the board report. See People and reports.
Settings
Organisation, Sending domains, Shared directory and Attachment measurement (Admins), and the Audit log. See Set up BAIT.
Choose the BAIT logo to return to Home from anywhere. While you are in the campaign wizard, the navigation is hidden and the top bar shows Save draft and exit instead.
Home
Home greets you with your organisation's name and today's date, and a one-line summary such as "0 campaigns live, 2 coming up. 1 thing needs your attention."
Until setup is finished, Home shows Set up your programme with three steps instead of the dashboard. See Set up BAIT.
After setup, Home shows:
Needs your attention: things only you can move forward. Each item has a button:
Approval: a campaign that is waiting for your approval. Choose Review.
Draft: a campaign you have not finished. Choose Continue.
Domain: a receiving domain that is not verified yet, with "People on this domain are skipped until its DNS record is found." Choose Check DNS. When there is nothing to do, it says "Nothing needs you right now."
Live now (or Paused): the campaign that is sending, how far it has got, and Open campaign →. When nothing is running it says No campaign running and "The next one starts when it's approved and its start date arrives."
Resilience: your programme score. Before any campaign has closed it says "No results yet. Your score appears after the first campaign closes." Choose View reports → to open Reports.
Coming up: scheduled campaigns and campaigns waiting for approval, by start date. When there are none it says "Nothing scheduled."
Language and theme
Choose EN or NL to switch the console between English and Dutch.
Choose the sun or moon icon (Switch between light and dark) to change the theme.
BAIT remembers both choices for you, on every device you use.
Tasks
Task
Who
Page
Set up the organisation, domains, people and Data Protection Officer
The Bait Assistant helps Admins design a scenario: the email, an attachment and the scenario's simulation web address. It writes its proposal straight into your unsaved draft in the Scenario editor and never saves, submits or approves anything. You review the changes and save them yourself. See Bait Assistant.
Reports and exports
Board report: a summary of the programme for your management, from Reports › Export board report. The file is a Markdown (.md) text file. See Export the board report.
Test document: a sample copy of a scenario's attachment, from the Scenario editor. It cannot affect campaign results. See Attachment.
There is no spreadsheet export of campaigns, groups or the audit log.
How BAIT protects you
Two people, every time. A campaign is sent only after someone other than its author approves it. A scenario your organisation writes can be used only after someone other than its writer approves it. Changing an approved campaign sends it back to draft, and its approval must be given again.
Approved wording is kept. Editing an approved scenario sends it back to review. Campaigns that were already approved keep the wording they were approved with.
Only domains you own. Nothing can be sent for approval, or approved, until at least one receiving domain is verified with a DNS record. Every address is checked again just before sending: addresses on an unverified domain are skipped, and so are addresses that previously bounced or complained.
Per-group results. Results, follow-up and the board report are per group. A group nobody has tested shows "No results yet", never 0%.
Identifying a person needs your Data Protection Officer. A request to identify individuals is refused while no Data Protection Officer is named, and the Data Protection Officer cannot make the request themselves. Every request is recorded in the audit log.
Employee details stay out of sight. Employee email addresses and names are stored encrypted and are never shown in the console.
Safe simulation content. Real links and remote images are removed from simulation emails, and attachments never contain macros or other executable content.
Gradual sending, with a pause button. Sending is spread over working days (Monday to Friday) and kept inside the send window you choose. Pause sending stops further emails at once.
Nobody gets the same test twice. If BAIT cannot tell whether an email was delivered, it does not send it again.
An audit log. Approvals, pauses, domain checks, directory syncs, identity-reveal requests and changes of Data Protection Officer are recorded under Settings › Audit log.
Troubleshooting
Message
What it means
What to do
"We can't show your programme right now" with "No campaign was changed. Scheduled and live campaigns keep running."
BAIT could not load your data.
Choose Try again. Your campaigns are not affected.
"Refused: You do not have permission to do that. This action needs an administrator of this BAIT installation."
The action is for Admins only.
Ask an Admin to do it.
"Your session has ended. Reload the page to sign in again."
You were signed out.
Reload the page and sign in on the Soveryne sign-in page.
"BAIT is being asked to do too much at once. Try again in a moment."
