Setting up Vlumeaware

Everything needed to get from an empty account to your first simulation, grouped by area. Work through them roughly top to bottom — the steps under People and the mail-gateway step need other people (your DNS administrator and your IT team), so start those early.

Security

Secure the account

This console can send mail that looks like it comes from your company. Lock it down before you populate it.

Sign in at the client portal and change the password you were given.
Under Security, set the password policy your team must meet and how long a session lasts.
If your organisation requires it, switch on "Require multi-factor authentication", then turn MFA on for your own account with "Turn on MFA".
On the same page, use "Add a console user" to add a colleague as a second admin, or as a viewer if they only need to read reports. They receive an email with a one-time link and choose their own password — you never set or see it. "Reset password" sends a fresh link, and "Deactivate" withdraws access immediately — the record is kept, so it can be restored.

Switching on "Require multi-factor authentication" applies to the console accounts you create from that point on. Anyone who already has an account is asked to enrol the next time they sign in, but is not locked out — so if you need the whole team covered immediately, say so to your Vlumetech contact and they will set it per account.

Branding

Brand the programme

Your logo and colour appear on the pages your employees see after they click, and on the certificates they earn.

Upload your logo. PNG or JPEG, up to 2 MB.
Set your brand colour, which is used on the landing pages and certificates.
Choose a certificate template: formal, branded, or record.

Do this before your first campaign. The teachable-moment page is white-labelled, and a page that does not look like your company teaches the wrong lesson.

People

Prove you own your domain

Simulations are domain-bound: we will only send to addresses on a domain you have proved you own, so a typo in a roster can never mail a stranger. Do this before adding employees.

Add your domain, for example acme.com.
Add the TXT record we show you at the host _vlumeaware.acme.com, with the value vlumeaware-verify= followed by the token on screen.
Wait for the record to publish, then verify. The check reads your live DNS.

Skipping this is the single most common cause of an empty campaign. Employees on an unverified domain are not rejected loudly — they are skipped row by row, with a reason you will see in the upload result.

Add your people

The roster is who gets simulated. Only new people consume a licence seat; re-uploading the same list is safe.

Export your staff list as CSV with the columns email, name, department.
Upload it. You will get a count of who was added and, for each row that was skipped, why.
Add anyone who joins later the same way, or one at a time.

Upload results speak plainly, and the reasons are worth reading: "invalid email address", "missing name", "acme.com is not a verified domain", "no verified domains yet — verify your domain first", "duplicate within file", or "seat limit reached". Those last two mean your licence or your DNS, not your file.

Choose how simulations are sent

This decides the address your simulations appear to come from. It must be a domain verified with our mail provider, or the send is rejected.

Take the shared Vlumeaware sending domain, which needs no setup from you.
Or add your own, for example acme-security.com, and publish the DNS records the page shows you. Keep it separate from the domain you actually use for mail.
Give each one a sender title, for example "IT Service Desk". That is the name staff see, and it is what makes the simulation realistic.

Use a lookalike domain you own, not your real mail domain. Training staff to distrust your genuine address is the opposite of the point. The page also shows whether SPF, DKIM and DMARC are in place.

Let the simulations through your mail gateway

Your own filters will quarantine a simulation unless they are told not to. This step needs your IT team, and it has a lead time measured in days — start it now rather than the day you plan to launch.

Send the delivery test from the Domains page to an address inside your organisation.
Open the test message from inside your mail system, which confirms the gateway let it through and marks your account as allow-listed.
If it does not arrive, send your IT team the block under "For your IT team" below. It lists what to allow, and the Microsoft 365 Advanced Delivery steps if you use it.

A campaign will not launch until this is confirmed. That is deliberate: a simulation that never reaches the inbox produces a report that measures nothing.

Training

Add awareness content

This is what plays after someone clicks. It is the difference between a gotcha and a lesson, and it is what the certificate certifies.

Upload a video with "Upload a video", or paste a link to one you already host and choose "Preview this link" to check it plays.
Give it a title, a duration in seconds, and a description.
Or browse the shared Vlumeaware library and use "Add to my library" to clone a module into your own.

A clone refers to the same stored video, so nothing is duplicated and the share counts against nobody.

Attach a quiz

Optional, but a quiz is what turns "I read the page" into a recorded pass and a certificate.

Author a quiz question by question, or upload one as CSV with the columns prompt, option1..optionN, correct, explanation.
Attach the quiz to the awareness module it belongs to.

Answers are never sent to the browser. Questions are served without the correct option, and scoring happens on the server, so the answer cannot be read from the page source.

Connect a click to training

Without a routing rule, a click is recorded and nothing else happens. This is the rule that assigns the lesson.

Pick the scenario on the left and the awareness module it should lead to.
Save the rule. One rule per scenario.

Do this before you launch. Adding it afterwards works, but the people who already clicked will not have been assigned anything.

Phishing

Pick a simulation

The template catalogue is ready-made and already labelled by industry, category and difficulty. It is the fastest way to something realistic.

Filter the catalogue to your industry, then use "Preview" to see the mail as a target would.
Choose "Clone to my library" to take a copy. It becomes an ordinary scenario you can edit freely.

Nothing you clone affects anyone else, and nothing is sent until you attach it to a campaign.

Or write your own

A simulation built around a process your staff really use — an invoice, a delivery, a payroll notice — lands harder than a generic one.

Use "Generate with Vlumeaware AI" to draft one from your industry and a sentence of context, then edit it.
Or build it yourself: "Compose visually" for a rich editor, or "Compose manually" for raw HTML. Use the tracking-link and employee-name placeholders so clicks are recorded.
Check the live preview, then "Save to library".

The preview shows exactly what will be stored, because the body is sanitized before it is ever rendered. Scripts, forms and event handlers are stripped — appearance is allowed in, behaviour is not.

Run your first campaign

This is the one that actually trains your people.

Create a campaign, attach the scenario, choose the sending domain and the sender title, and pick the landing page your targets will see.
Work through the preflight checklist on the campaign page. It will not let you launch until every line is green: the agreement signed, employees uploaded, at least one scenario attached, a verified sending domain chosen, the tracking domain configured, and your IT allow-list confirmed.
Choose "Launch", or "Schedule send" to set a date and an optional repeat. A send window spreads deliveries out instead of firing them all at once.
Keep the kill switch in mind: pausing or killing a campaign stops queued mail immediately, not just future mail.

On a free trial: On a free trial you can prepare everything, but campaigns are locked until Vlumetech approves the account and the authorization agreement is on file.

Reporting

Read the results

The report tells you who is a risk, not just what happened.

Open the campaign for delivery, open, click and report rates, the trend over time, and a written summary.
Export the campaign as CSV when someone asks for the detail.
Go to Reporting ▸ Risk for a running risk score per person across every campaign, the repeat clickers, and one-click enrolment into a remediation module.
Reporting ▸ Certificates lists issued certificates. Each has a serial anyone can verify.

Going live

Then keep it running

One campaign is a test. A programme changes behaviour.

Schedule the next campaign to recur, so nobody gets one test and no follow-up.
Opt in to the weekly digest if you would rather the results came to you.
Watch your seat usage against your licence as you hire, under License.
Check the audit log under Security if you need to know who changed what.

On a free trial

You can do everything on this page except run a campaign, which unlocks once Vlumetech has approved the account and the authorization agreement is on file. Up to 20 employees while on trial. After 7 days, if the account is still unapproved, it becomes read-only — you can look, but not add or author — until it is approved.

What your employees will see

Worth sending round before your first campaign, so nobody feels ambushed:

They receive a simulated phishing email. It looks like a plausible internal message, and it comes from a domain used for training rather than the real one.
If they click, they land on a page that looks like a sign-in. It records only that a submission happened, plus non-reversible details such as how long the fields were. What was typed is never seen, stored or transmitted.
They are then shown plainly that it was a simulation, why it worked, and the warning signs they missed.
They are given the short lesson attached to that scenario, and a quiz if one is attached. Passing marks the training complete.
They get a certificate they can keep. Anyone can verify it by serial.

One thing to be plain about: a password is never captured. The simulated sign-in reports only that something was submitted, plus non-reversible details like field lengths. That is a deliberate limit, and it is why no password from a simulation can leak.

For your IT team

The gateway allow-list is the one step that cannot be done from the console. Copy the block below and send it on — it is written to stand on its own.

Vlumeaware — what our mail gateway needs to allow

We are running phishing simulations through Vlumeaware to train staff. Our
filters will quarantine these messages unless the sending infrastructure is
allow-listed. Please apply the following.

1. Allow the sending domain
   The domain shown under Sending domains in our Vlumeaware console.
   If we are using the shared Vlumeaware domain it is on the Domains page.

2. Allow the link and tracking domains
   Simulation links and open-tracking pixels are served from separate domains
   from the sending domain. All of them are listed on the Domains page in our
   console, under link / tracking domain and training / landing domain.

3. Allow the sending IP addresses
   Listed on the Domains page under "Sending IPs". Microsoft 365 in particular
   requires the sending domain AND the IP — the domain alone is not enough.

4. Microsoft 365 / Exchange Online only
   Add a phishing simulation override so Defender does not action these:
   Security portal > Email & collaboration > Policies & rules >
   Threat policies > Advanced delivery > Phishing simulation tab.
   Add the sending domain and the sending IPs there, and set the simulation
   URLs to be allowed.

5. Publish SPF, DKIM and DMARC for our sending domain
   The sending domain must be verified with our mail provider first. The
   Vlumeaware console shows whether each record is in place.

6. Confirm
   Once applied, tell us. We will send a test message to an address inside the
   organisation; opening it from inside our mail system confirms the change
   worked end to end.

Still stuck? Anything that does not behave as this page describes is worth reporting — tell your Vlumetech contact which step and what you saw.