People and reports

Part ofRun a phishing-awareness programme

This page explains the People and Reports pages: your employee groups, the results of your campaigns per group, the board report for your management, and how BAIT keeps individual results private.

Who does what

Role	What they do here
Admin	Everything a User does, plus Sync now on People and Request identity reveal (audited).
User	Read People and Reports, and export the board report.

Before you begin

Your employee groups are imported. See Import your employee groups.

Reports fill in once your first campaign has started sending. See Campaigns.

People

People lists your employee groups. Groups are the unit of everything in BAIT: campaigns are sent to groups and results are reported per group. No individual employee is ever listed.

Choose People.

The People page with six groups, their size, last campaign and resilience

The line at the top says how many group memberships there are across how many groups. A person in two groups counts twice. After a directory sync, the line also says when BAIT last synced from MESH.

Column	What it shows
Group	The group's name, as in your directory.
People	How many people are in it.
Last campaign	The most recent campaign that included the group, with its date, or "live" while it runs. "None yet" if no campaign has reached it.
Resilience	The group's resilience score, or "No results yet".

A group that has been removed from your directory stays in the list with 0 people, so its history is kept.

Individual results are masked by default.

Refresh the groups

WhoAdmins only.

Choose Sync now.

BAIT takes the latest groups and members from MESH and shows the result, for example "Synced just now · 12 joiners added, 3 leavers removed". See Import your employee groups for what to do if the sync is refused.

If BAIT says "Not connected to a directory yet", connect your directory in MESH first.

Reports

Reports shows the results of the last 12 months, all aggregated per group or per campaign.

Choose Reports.

The Reports page before any campaign has sent, showing No results yet

Until your first campaign has started sending, the page says No results yet and "Reports fill in once your first campaign has started sending."

After that, the page holds these sections.

Resilience over time

One pair of bars per quarter: Did not click and Reported the email, each as a percentage. A quarter that is still running is marked "(in progress)".

Note

BAIT does not record clicks or entered data for link-based campaigns yet, so the figures that depend on them are not available for those campaigns. See What BAIT measures.

Follow-up training

Lists the groups that need follow-up after the latest campaign, with the number of people in each. Names stay masked. When nobody needs follow-up, it says "Nobody needs follow-up training right now."

Compliance summary

A checklist of evidence about your programme over the last 12 months:

whether the awareness programme is active, and how many campaigns ran;

whether every group was reached at least once;

how the report rate changed over the quarters;

how much follow-up training was assigned for the latest campaign.

The checklist helps you collect evidence for your awareness programme. It is not a certification.

Attachment outcomes

Shown once a campaign with an attachment has sent. For each such campaign it shows Likely human, Suspected scanner, Uncertain and Not observed. "Not observed" means BAIT received no signal it accepts, for example because the reader blocked it; it does not mean the document was not opened. Choose a row to open the campaign.

To help BAIT tell people from mail scanners, an Admin can fill in Settings › Attachment measurement. See Attachment measurement.

Campaign results

A table of campaigns with the columns Campaign, Sent, Opened, Clicked, Entered data and Reported. A campaign that has not sent shows "—" instead of a rate. Campaigns with an attachment are shown under Attachment outcomes instead. Choose a row to open the campaign.

Export the board report

The board report summarises your programme for your management.

WhoAdmins and Users.

Choose Reports.

Choose Export board report. The strip below shows "Board report queued" and then the progress.

When the strip says "Board report ready", choose the download link next to it to save the file.

The board report is a Markdown (.md) text file. You can open it in any text editor, or convert it to PDF or a word-processor document with a Markdown converter. It contains:

the programme title with your organisation's name, the date it was generated and the period;

Resilience over time, per quarter;

Campaigns, with the number delivered and the results per campaign;

Attachment observations, if you ran a campaign with an attachment;

Compliance evidence, a checklist with a note that it is not a certification;

What this report does not say: it holds no individual results, follow-up is per group, and identifying an individual needs a request approved through your Data Protection Officer.

Everyone on the programme team can download a board report once it is generated.

If the strip says "Board report refused" or "Board report failed", choose Retry.

What BAIT measures

Result	Measured today?
Delivered: simulation emails delivered to employees	Yes
Attachment outcomes: Likely-human opens observed, Suspected scanner, Uncertain activity, Not observed	Yes, for campaigns with an attachment
Opened, Clicked link, Entered data for link-based emails	Not yet
Reported: employees who reported the simulation	Only when reports from employees are connected for your workspace. Ask your Soveryne contact.

Remote images are removed from simulation emails, so BAIT does not measure whether a link-based email was opened.

Privacy

BAIT is built so that your awareness programme measures groups, not people.

Results are per group. The console, the reports and the board report show results per group or per campaign. No page lists an individual employee.

Follow-up is per group. Follow-up lists show groups and the number of people, never names.

Employee details stay out of sight. Employee email addresses and names are stored encrypted and are never shown in the console.

Untested is not zero. A group that no campaign has reached shows "No results yet", never 0%.

Request an identity reveal

Sometimes you may have a legitimate reason to know who is behind a result. BAIT treats that as a separate, audited request that needs your Data Protection Officer.

WhoAdmins, other than the Data Protection Officer.

Choose Reports.

In Follow-up training, choose Request identity reveal (audited).

BAIT records the request in the audit log as "Requested identification of individuals in a campaign". It does not show anybody's identity: the Data Protection Officer cannot approve requests in BAIT yet.

BAIT refuses the request, in a red Reveal request refused panel, when:

Message	What to do
"Reveal requests need a Data Protection Officer on file. Add one under Settings › Organisation."	An Admin names your Data Protection Officer. See Name your Data Protection Officer.
"You are the Data Protection Officer on file, so you cannot be the one who asks. Someone else has to request this."	Ask another Admin to make the request.

Troubleshooting

Message or symptom	What it means	What to do
No results yet on Reports	No campaign has started sending.	Wait until your first campaign is live.
Export board report is not shown	There are no results to report yet.	Wait until your first campaign has sent.
Sync now or Request identity reveal (audited) is not shown	These actions are for Admins only.	Ask an Admin.
"Sync refused" or "Sync failed"	BAIT could not refresh the groups.	Read the reason under it, then choose Retry. See Import your employee groups.