Scenarios

Part ofRun a phishing-awareness programme

A scenario is a simulation email, with an optional attachment and web page, that a campaign sends. This page shows you how to find scenarios in the Marketplace, write or edit your own in the Scenario editor, get them approved, and use the Bait Assistant.

Who does what

Role	What they do with scenarios
Admin	Browse the Marketplace; write, edit and save scenarios; approve a scenario someone else wrote; fill in the Loki configuration tab; use the Bait Assistant.
User	Browse the Marketplace and open scenarios in the editor. Users cannot save or approve scenarios, open the Loki configuration tab or use the Bait Assistant.

Nobody can approve a scenario they wrote.

Before you begin

You know which goal you want to test. Every scenario belongs to one of the four campaign goals: Baseline measurement, Credential harvesting, Invoice & payment fraud or Unexpected attachment. See Campaigns.

For a scenario's web page (for example a teaching page employees see after they choose the link), your Soveryne contact sets up the simulation service for your workspace.

How scenarios are reviewed

Status	What it means
Ready	Approved. Campaigns can use it.
In review	Saved, but a second person has not read it yet. Campaigns cannot use it.

Soveryne's scenarios arrive already reviewed and Ready. Their source shows as Soveryne.

A scenario you write starts In review. Its source shows as Yours. An Admin other than the writer reads and approves it.

Editing any approved scenario, including one of Soveryne's, sends it back to In review. Campaigns already approved keep the wording they were approved with.

Browse the scenario library

WhoEveryone on the programme team.

Choose Marketplace.

To narrow the list:

type in Search scenarios… (it searches the name, description, subject and goal);

choose a Goal, a Difficulty (1, 2 or 3) or From (Soveryne or Yours). The number of matching scenarios is shown on the right. Choose Clear filters to see everything again.

The scenario gallery with a grid of scenario cards showing their goal, level, status and source

Each card shows a preview of the email with its Level (1 is the easiest to spot, 3 the hardest), the goal, the status, the name, a one-line description and the source. Scenarios in review are listed first.

Choose a card to open it in the Scenario editor. On hover, the card says Open in editor for an approved scenario and Review and edit for one in review.

If nothing matches, the page says "Nothing matches those filters." with Clear filters.

To use a scenario in a campaign, you don't need to add it anywhere: every Ready scenario appears in step 3 of the campaign wizard. See Step 3: Email.

Write or edit a scenario

WhoAdmins. Users can open the editor and read every tab; instead of the save and approval buttons they see "Only administrators of this BAIT installation can do this."

Watch: looking through a scenario in the Scenario editor (about 1 min)

In the Marketplace, choose + New scenario to start from scratch, or choose a card to edit an existing scenario.

Work through the tabs at the top: Scenario settings, Scenario content, Attachment and Loki configuration. The sections below describe each one.

Choose Save and send for review (a new scenario) or Save (an existing one).

For a new scenario, BAIT says "Saved. It is in review until a second person reads it." For an existing one it says "Saved. It is in review." If BAIT changed something while saving, it says "Saved. Read the note above." and the note explains what changed, for example "Removed from the email: …".

When you save changes to an approved scenario, BAIT tells you: "This scenario was approved, so the change sent it back to review. Campaigns already approved keep the wording they were approved with."

The editor highlights Marketplace in the navigation. Choose Marketplace to go back to the gallery.

Scenario settings

The first tab shows the scenario's status at the top: "Not saved yet. Saving puts it in review.", "In review. A second person has to read it before a campaign can use it." or "Approved by name. Editing it sends it back to review."

Field	What to enter
Name	What the exercise is called. Up to 120 characters.
What it tests, in one line	Shown on the scenario's card in the Marketplace. Up to 280 characters.
Goal	One of the four campaign goals.
How hard to spot	1 — most people should spot it, 2 — ordinary business mail or 3 — careful and plausible.
Language	English or Dutch.
From	The sender name and address the email appears to come from.
Subject	The subject line.

Scenario content

This tab holds the email itself. Switch between two views at the top:

Live email: a visual designer.

HTML source: the email's HTML, under Edit email HTML.

The Scenario content tab with the visual email designer

In Live email:

Add elements from the palette on the left: Heading, Text, Button, Image (PNG, JPEG or WebP), Divider, Spacer and Basic shapes.

Select an element to edit it. Type directly into text. Drag the grip or border to move it, or the handles to resize it.

Use the toolbar above the selected element to change the font, size, bold and italic, colours, alignment, width and height, an image's description, and its layer order, or to duplicate or delete it.

Use Insert placeholder to add details that are filled in for each recipient when the email is sent: | Placeholder | Filled in with | When BAIT has no value | |---|---|---| | First name | The person's first name | a neutral word such as "colleague" | | Last name, Full name, Email, Department, Job title | The matching detail from your directory | a neutral default | | Organisation | Your Organisation name from Settings | "your organisation" |

Keyboard shortcuts: Ctrl+Z undo, Ctrl+Y redo, arrow keys move (with Shift, 10 pixels at a time), Esc cancels a drag.

When you save, BAIT makes the email safe to send: links are replaced by the simulation's own link, and remote images are removed. The email must stay under 200 kB.

Attachment

Use this tab for the Unexpected attachment goal. Turning an attachment on switches the scenario's goal to Unexpected attachment.

Turn on Include ("Include this document in the scenario").

Enter a Filename and choose a Format: DOCX, XLSX or PDF.

Build the document on the canvas: a title, paragraphs, headings, tables and a link line. Use the toolbar to add blocks, change their style, size, alignment and colour, move or remove them, and Personalise… to add recipient placeholders. An XLSX document shows a spreadsheet grid.

Choose Preview to see the document with sample recipient values, and Edit to return.

Choose Test file to download a test copy. BAIT says "Test document downloaded. It cannot affect campaign results."

Attachments never contain macros or other executable content. Each format shows a short note about what readers may block; for example, Word may block external images. When a reader blocks the signal, BAIT records the result as inconclusive rather than as "not opened".

Approving a campaign with an attachment also needs a mail route that can send attachments. Your Soveryne contact sets this up.

Loki configuration

WhoAdmins only. Users see "Administrator access required" and can choose Back to scenario content.

This tab connects the scenario to its simulation web address: the page an employee reaches when they choose the link in the email, such as a lookalike sign-in page or a teaching page. The simulation service behind it is set up by your Soveryne contact; you usually fill in this tab with them.

The tab holds:

Live domain preview: choose Load preview to see the scenario's web address as employees will, or Open in new tab ↗. The preview shows the saved configuration, so save your changes before you reload it.

HTML landing page: upload a self-contained HTML page (UTF-8, up to 1 MiB) and the path it is served on. Some Soveryne scenarios come with a teaching page; choose Use included landing page to use it.

01 Domain route: the Client-facing domain employees see, and where it leads.

Redirects, Request rules and Response rules: optional adjustments, each added with + Add rule.

Advanced · JSON import and preview.

To keep your changes, choose Save Loki configuration in the Scenario connection card. Discard changes and reload throws away unsaved changes. Save a new scenario first: until then, the tab says the configuration is part of your unsaved scenario.

Approve a scenario

WhoAdmins who did not write the scenario. Every Admin can approve, unless their account has been marked as not an approver.

In the Marketplace, choose a card that shows In review.

Read every tab, including the email in Scenario content and any attachment.

Choose Approve at the top right.

BAIT says "Approved. It can be chosen in the campaign wizard now." The scenario shows Ready and appears in the campaign wizard.

If Approve is greyed out, hold the pointer over it to see why:

Reason	What to do
"Save it first."	Save the scenario.
"Approved already."	Nothing to do.
"You wrote this one. A second person has to read it."	Ask another Admin to approve it.
"Your account is not marked as an approver."	Ask your Soveryne contact.

Every save sends a scenario back to review, so approve it only after the last change.

Use the Bait Assistant

The Bait Assistant is a design assistant on the right of the Scenario editor, on every tab. It helps you write the email, design an attachment, and fill in the Loki configuration.

WhoAdmins only. Users see "Only administrators of this BAIT installation can do this." above the message box.

Open a scenario in the editor. The panel shows what the assistant is looking at ("Email design", "Attachment design" or "Loki configuration") and "Uses your current draft".

Type what you want in the message box, for example "Make the subject more urgent" or "Write a parcel-delivery notice for our customer service team". Press Enter to send; Shift + Enter starts a new line.

Wait while the assistant works ("Bait Assistant is thinking…").

When it has a proposal, the assistant writes it straight into your editor and BAIT says "Draft updated. Review your changes before saving."

Review every change on every tab.

Choose Save (or Save and send for review) to keep it. For the Loki configuration tab, also choose Save Loki configuration.

Choose New chat to start a new conversation. Your conversation is saved to your account for this scenario.

What the assistant can and cannot do

The assistant can:

propose a complete email: sender, subject, text, button and layout;

propose the scenario settings: name, description, goal, difficulty and language;

propose an attachment document;

propose or adjust the Loki configuration, and read the saved one;

use the recipient placeholders;

look up public web pages when you ask or when it needs current information, and cite them;

ask you questions when something is unclear.

The assistant never:

saves, submits or approves anything, or approves a campaign. Nothing it proposes is kept until you save it;

impersonates real named people or companies, or collects secrets;

adds scripts, forms, remote images or executable content;

invents web addresses. It asks you for missing details instead.

The assistant does not ask before it changes your unsaved draft. It never changes anything saved. If you edit the draft while it is working, it does not overwrite your edit; it says "Your draft changed while the assistant was working. Ask again to update the latest draft."

Troubleshooting

Message	What it means	What to do
"Give the email a subject line."	The Subject is empty.	Enter a subject in Scenario settings.
"The email is empty."	There is no content.	Add content in Scenario content.
"that email is too large to store; keep the HTML under 200 kB"	The email is too big.	Remove large elements or images.
"Select the attachment goal to attach a document"	An attachment is included but the goal is different.	Set the Goal to Unexpected attachment, or turn off Include.
"you cannot approve a scenario you wrote. Ask a colleague who can approve to read it first."	You wrote it.	Ask another Admin.
"The code editor could not load, so this is a plain text box."	The HTML editor did not load.	You can still edit the HTML as plain text, or use Live email.
"The Bait Assistant is not available to your account."	The assistant is for Admins only.	Ask an Admin.
"The assistant returned no message. Please retry." or "The assistant could not validate its proposal against the design tools. Please try again."	The assistant could not finish.	Send your request again.
"The design session is too large. Start a new conversation."	The conversation is too long.	Choose New chat.