Set up BAIT

Part ofRun a phishing-awareness programme

This page takes an Admin through setting up BAIT for your organisation: organisation details, the domains your staff receive email on, your employee groups, your Data Protection Officer and the second member of your programme team. When you have finished, your team can prepare its first campaign.

Who does what

Role	What they do here
Admin	Completes every step on this page.
User	Can open Settings › Organisation, Sending domains and Audit log and read them, but cannot save changes.
DNS administrator (outside BAIT)	Publishes one DNS TXT record for each receiving domain.
MESH administrator (outside BAIT)	Connects your directory in MESH, so BAIT can import your employee groups.

Before you begin

Gather the BAIT items from the Onboarding checklist:

your organisation's name, country and default email language;

every domain your staff receive email on, and someone who can publish a DNS TXT record for each one;

your employee directory connected in MESH (see Connecting sources);

a second person for the programme team, who will approve campaigns;

the person who is your Data Protection Officer.

Important

BAIT sends simulations through a mail route that your Soveryne contact sets up for your workspace. There is no screen for it in BAIT. Agree the route, the sender address and its SPF and DKIM records with your Soveryne contact before your first campaign. See Domains.

Set up your programme

When you first open BAIT, Home shows Set up your programme: "Three steps, about 15 minutes. Nothing is sent until a second person approves your first campaign." It has a counter such as "1 of 3 done". Each step has a Start button, or Edit once it is done. Home also tells you how many steps are left, for example "You're 2 of 3 steps away from your first campaign."

The setup flow hides the navigation and shows "Step 1 of 3" at the top. Use Continue to move on and Back to return. Choose Finish later at any time to go back to Home; what you have saved is kept.

WhoAdmins only.

Step 1: Your organisation

On Home, under Set up your programme, choose Start.

Enter the Organisation name. BAIT uses it on reports and in the organisation placeholder in simulation emails.

Choose the Country: Netherlands, Belgium, Germany, France or Luxembourg.

Choose the Default email language: Dutch, English fallback or English.

Choose Continue.

If the name is empty, BAIT says "Give the organisation a name first".

Step 2: Verify sending domains

BAIT calls these sending domains, but they are the domains your staff receive email on. BAIT sends a simulation only to an address on a domain you have proved you own.

In Add a sending domain, enter a domain your staff receive mail on, for example example.com.

Choose Add domain. BAIT says "Added domain. Publish the DNS record, then check it." and shows the record to publish.

Repeat for every domain your staff receive mail on, including subsidiaries.

Choose Continue.

You don't have to wait for the domains to be verified to finish setup. Publish the records and check them under Settings › Sending domains (see Verify a receiving domain). You cannot send a campaign for approval until at least one domain is verified.

Step 3: Import your people

Your employee groups come from your directory through MESH, Soveryne's shared register. BAIT reads the groups and their members from MESH, so audiences stay current.

Choose Use the shared directory in MESH. BAIT marks it "Recommended. Groups and people come from MESH and update after each directory sync, on MESH's schedule or with Sync now."

Choose Finish setup.

BAIT says "Setup complete. Start your first campaign when you are ready." and returns to Home. If your directory is already connected in MESH, BAIT imports the groups straight away. If it is not, connect it in MESH first, then choose Sync now on People (see Import your employee groups).

Verify a receiving domain

WhoAdmins only.

Choose Settings (the sliders icon at the top right).

Choose Sending domains. Each domain shows Verified or Waiting for DNS.

Settings › Sending domains with one verified domain and one waiting for its DNS record, with the record to publish

For a domain that shows Waiting for DNS, copy the record shown under it. It looks like this: `` TXT _bait-verify.example.com "bait-site-verification=<token shown in BAIT>" ``

Ask your DNS administrator to publish the record. It sits on its own name, so your existing SPF and DMARC records are not touched.

Back in BAIT, choose Check DNS. The strip under the domain shows "DNS check queued", then "Checking DNS…", then the result.

When BAIT finds the record, the strip says "Verified — record found" and the domain shows Verified. The token for a domain never changes, so checking again never breaks a record you have already published.

To add another domain here, enter it in Add a sending domain and choose Add domain. Adding a domain that is already listed shows the same record again. Domains cannot be removed in the console.

Until a domain is verified, Home shows it under Needs your attention with "People on this domain are skipped until its DNS record is found." Employees on that domain receive nothing.

If the record is not found

Message	What to do
"TXT record … was not found at your domain's own nameservers. DNS changes can take up to an hour to publish."	Check the record name and value, wait, then choose Check DNS again.
"Could not reach the nameservers for …, and the resolver has no such record. If you have just published it, its nameservers may still be starting up."	Wait a while, then check again. If it keeps failing, ask your DNS administrator whether the domain's nameservers answer.
"A bait-site-verification record exists at … but carries a different token. Replace it with the line shown above — a token from another domain or another BAIT install does not prove this domain."	Replace the published value with the exact line BAIT shows for this domain.
"'…' is not a domain name"	Enter only the domain, for example `example.com`, without `https://` or an email address.

See Domains for how receiving domains differ from the other kinds of domain in Soveryne.

Import your employee groups

BAIT does not keep its own employee list. Employees and their groups come from your directory, which you connect in MESH. MESH refreshes people and groups from your directory on its own schedule (see Connecting sources). BAIT takes the latest groups from MESH when you choose Sync now on People.

WhoAdmins only.

Connect your directory in MESH

Choose Settings, then Shared directory.

Read the status:

"Shared inventory available from MESH": MESH has a directory for BAIT to use.

"Connect a directory in MESH to import groups and people.": nothing is connected yet.

Choose Open MESH to go to the MESH console, and connect your directory there. See Connecting sources.

If BAIT says MESH is not configured yet, ask your Soveryne contact to finish the link between BAIT and MESH.

Bring the groups into BAIT

Choose People.

Choose Sync now. The button shows Syncing… while BAIT works.

The strip above the table shows the progress and then the result, for example "Synced just now · 12 joiners added, 3 leavers removed". The groups appear in the table with the number of people in each.

People who have left are excluded after the next directory sync. That includes a campaign that is already sending: they receive no further simulations from it. Campaigns that already ran keep their history.

A group that disappears from your directory stays in the list with 0 people, so its history is not lost.

If your directory is not connected yet, Sync now opens Settings › Shared directory instead.

Message	What to do
"Review the audience comparison in MESH before switching Bait to the shared directory."	In MESH, review and accept the comparison of your directory with BAIT's current groups, then choose Sync now again.
A message that another sync is already running	Another sync is in progress. Wait a moment, then choose Retry.
"The stored audience could not be read, so nothing was changed. No groups were removed."	Choose Retry. Your groups are unchanged.

Name your Data Protection Officer

Results in BAIT are per group. Identifying an individual behind a result needs a separate request, and BAIT refuses every such request until a Data Protection Officer is named.

WhoAdmins only.

Choose Settings, then Organisation.

Settings › Organisation with the organisation name, country, default email language, timezone and Data Protection Officer

In Data Protection Officer, choose the person. While nobody is chosen, the list shows "Nobody yet — reveal requests will be refused".

Choose Save organisation. BAIT says "Organisation saved".

The change of Data Protection Officer is recorded in the audit log as "Changed the Data Protection Officer on file".

The list shows the people on your programme team who have already opened BAIT. If the person you want is missing, ask them to sign in and open BAIT once, and then try again.

Edit your organisation details

WhoAdmins only.

On Settings › Organisation you can also change:

Organisation name;

Country: Netherlands, Belgium, Germany, France or Luxembourg;

Default email language: Dutch, English fallback or English;

Timezone: Europe/Amsterdam, Europe/Brussels, Europe/Berlin or Europe/Paris. The send windows of your campaigns, and the dates and times BAIT shows, follow this timezone.

Choose Save organisation to keep your changes.

Note

The scenarios in Soveryne's library are written in English. The default email language records your organisation's preference; each scenario has its own language.

Add the second member of your programme team

Nobody can approve their own campaign, so you need at least two people on the programme team before anything can be sent.

Make sure your colleague can sign in to BAIT with the Admin or User role. See Single sign-on. People who sign in start as User; the Admin role is granted separately.

Ask them to sign in and open BAIT once. From then on they appear in the Approver list of the campaign wizard and can be chosen as Data Protection Officer.

Every member of the programme team can approve a campaign, except one they created. Admins can also approve scenarios, except one they wrote.

Note

BAIT does not notify an approver by email. When you send a campaign for approval, tell your approver yourself. It appears for them on Home under Needs your attention.

Attachment measurement

If you run campaigns with an attachment, BAIT tries to tell genuine opens by a person from automatic opens by a mail scanner. You can give it information about your own network to help.

WhoAdmins only.

Choose Settings, then Attachment measurement.

Fill in any of these, one entry per line:

Corporate networks: known ranges your organisation's traffic leaves from, written as address ranges.

Verified scanner networks: ranges you have confirmed belong to a mail scanner.

Expected document readers: text that identifies the document readers your staff use, for example Microsoft Word.

Scanner signatures: text that identifies your verified mail scanners.

Choose Save measurement settings. BAIT says "Saved. Existing campaign policies are unchanged."

These settings are fixed into each campaign when it is approved, so a change affects only campaigns approved afterwards. Network ownership or a late request alone never counts as an open by a person. Raw IP addresses and full reader details are discarded after each observation is classified.

Check the audit log

The audit log shows who did what in BAIT, newest first, with the date and time.

WhoEveryone on the programme team.

Choose Settings, then Audit log.

Settings › Audit log listing recent actions with their time and the person who took them

Entries include requesting, approving and sending back campaigns; pausing, resuming and cancelling them; adding and verifying receiving domains; directory syncs; writing and approving scenarios; identity-reveal requests; and changes of Data Protection Officer. Automatic actions are shown with "System" as the actor. Entries describe the action, not the campaign's name.

The audit log cannot be filtered or exported. When nothing has happened yet it says "No activity yet."

Troubleshooting

Message	What it means	What to do
"Only administrators of this BAIT installation can do this."	Setup steps and settings are for Admins only.	Ask an Admin.
"Give the organisation a name first"	The Organisation name is empty.	Enter a name, then save.
"Type the domain your staff receive mail on"	Add domain was chosen with an empty box.	Enter a domain.
"no sending domain is verified yet, so nothing could be delivered. Verify a domain under Settings › Sending domains first."	You tried to send a campaign for approval before any domain was verified.	Verify at least one domain.