Question 1

How long does it take to go live?

Accepted Answer

A baseline campaign usually runs on day one. SSO and SCIM against a sandbox directory takes about twenty minutes, the allow-list wizard produces the exact rules for your mail platform, and there is no endpoint agent to package. A full phased rollout across departments is typically two weeks.

Question 2

Do we need to import a list of people?

Accepted Answer

No. People come from Entra, Okta, Google or LDAP over SCIM or directory sync, and audiences are dynamic rules on directory attributes. A new joiner is in scope the day their account is created, and a leaver is out of scope in the same sync your identity provider runs.

Question 3

What does the first month actually look like?

Accepted Answer

Week one: connect identity, generate allow-list rules, baseline a pilot group. Week two: baseline the organisation and switch on auto-enrolment. Weeks three and four: continuous adaptive campaigns, then your first Behavioral Risk Score with an industry percentile at day thirty.

Question 4

Is there an agent to install?

Accepted Answer

No. Delivery runs through your mail platform, identity through your identity provider, and reporting through an optional Outlook or Gmail add-in your admin deploys centrally. Nothing is installed on laptops or phones.

Question 5

Will simulated phishing emails actually reach the inbox?

Accepted Answer

Yes, and this is the part most programmes get wrong. SafeLoop generates the exact configuration for Microsoft 365 Advanced Delivery, Google Workspace and your secure email gateway, then runs an inbox-placement test to a seed group before every campaign goes live. If a rule is missing you find out before the send, not after.

Question 6

Do we have to change our SPF, DKIM or DMARC records?

Accepted Answer

No. Simulations send from SafeLoop-owned domains that you allow-list, so your own authentication posture is untouched. If you would rather send from a look-alike domain you control, that is supported and we walk your mail team through it during onboarding.

Question 7

Why can't you send from a normal email provider?

Accepted Answer

The acceptable-use policies of the major transactional email services prohibit simulated phishing, so any platform built on one is a single abuse report from suspension. SafeLoop runs dedicated simulation infrastructure with per-tenant sending domains, and uses transactional providers only for account notifications.

Question 8

How do you reach staff without a corporate mailbox?

Accepted Answer

Over SMS, using the mobile number already in your directory, and by outbound voice where that is in scope. Those people are usually the highest-exposure and least-measured cohort in an organisation, and they are graded on the same scale as everyone else.

Question 9

Do you store the credentials people submit?

Accepted Answer

Never. A submission is recorded as an event — who, which campaign, how long after delivery — and the person is coached immediately. The characters typed are discarded at the collector before any write to storage occurs. This is enforced in code rather than by policy, and is covered by our third-party penetration testing.

Question 10

Can managers see individual results?

Accepted Answer

Only within their own scope, and only if you enable it. Roles are organisation admin, department-scoped manager and employee. Every view of another person's record is written to the audit log, and the whole programme can run with individual results visible to the security team alone.

Question 11

Does the mail add-in read our email?

Accepted Answer

Only the message a person explicitly chooses to report. There is no background mailbox scanning, no journaling and no mail-flow rule that copies traffic to us. Permissions are scoped to the reported item.

Question 12

What lures will you refuse to send?

Accepted Answer

Anything using redundancy or termination, pay and bonus changes, medical results, bereavement, or a live disaster as the pretext. They produce excellent click rates and lasting damage. If a programme needs distress to generate a result, it has a content problem rather than a measurement opportunity.

Question 13

Where is our data held?

Accepted Answer

In the region you select at provisioning — EU (Ireland), UK (London) or US (Virginia) — including backups. Processing does not cross the boundary, and the published subprocessor register lists the region applicable to each processor.

Question 14

How is the Behavioral Risk Score calculated?

Accepted Answer

Ten factors across three groups — susceptibility, resilience and exposure — are each graded, weighted and combined into a resilience score from 0 to 100, which maps to an A–F band. It is computed identically at person, team, department and organisation level, and benchmarked against organisations of similar industry and size.

Question 15

Why a letter grade instead of a percentage?

Accepted Answer

Because a percentage invites arguments about noise. A band only changes when behaviour changes, and it reads correctly to a non-technical audience without a legend. We grade resilience rather than risk, so higher is always better.

Question 16

Does training completion drive the score?

Accepted Answer

It is one of ten factors and deliberately not the heaviest. Completion measures attendance; the score weights what people do when tested — susceptibility, report rate and real-threat response — so a department cannot grade well by clicking through courses.

Question 17

Can we pull the score into our own reporting?

Accepted Answer

Yes. Read it over the REST API with the factor breakdown intact, or receive it on a signed webhook whenever a band changes. Several customers drive a GRC register entry or a warehouse dashboard directly from it.

Question 18

How is a seat counted?

Accepted Answer

One seat per person in scope for simulations or training. Administrators, service accounts and shared mailboxes are not charged, and admin seats are unlimited on every tier.

Question 19

What happens when our headcount changes?

Accepted Answer

Monthly plans true up automatically. Annual plans include a 10% headroom band before a mid-term adjustment, so ordinary hiring does not trigger a new purchase order.

Question 20

Which compliance frameworks does the evidence cover?

Accepted Answer

NIST CSF 2.0 (PR.AT), HIPAA §164.308(a)(5), PCI DSS v4.0 12.6.3, GDPR Article 39, ISO 27001:2022 Annex A 6.3 and SOC 2 CC2.2. The export is one pack per framework, with the control references already attached.

Talk to the right team, first time

See your own human risk in twenty minutes

Where to send it

Sales & demos

Customer support

Security disclosure

Privacy & data requests

Partnerships & MSPs

Press & analysts

Twenty answers, grouped

Where we are, legally and physically

London

Dublin

Remote

See your human risk in 20 minutes