Supervisor Statistics

In the Statistics section, the supervisor has access to an overview of the company's overall performance.

This section is divided into the following tabs:

• Overview
• Report Awareness
• Report Channel
• Report Phishing
• Report Remediation

The available tabs may vary depending on the services purchased.

Overview

This section contains the following widgets:

• Overall Participation
• User Distribution by Service
• Leaderboard

Overall Participation

The Overall Participation chart shows, as a percentage, the trend over time of the company's overall participation, broken down by the three services: Awareness, Channel, and Phishing.

In the Overview section statistics, if both Awareness and Channel services are active, the data shown is aggregated from both services. If only one of the two services is active, the data in the Overview matches the data shown in the dedicated section for that service.

• Awareness and Channel: the chart shows the percentage of modules completed by users out of the total modules released up to that point. The calculation is progressive: for example, in the first month only one module is considered, in the second month two modules, and so on.
• Phishing: the chart shows the percentage of emails opened compared to those sent, calculated month by month. Each point on the chart reflects the specific situation for that period, with no cumulative data.

The overall participation chart is updated every 8 hours.

Filtering Data

The data in the Overview can be filtered: by selecting the desired filters (choosing the values for the organizations of interest), the filter applies to all widgets in the section as well as to any downloadable reports.

Available Reports (Generate "Overview" Report)

The supervisor can download the data and generate a report in various formats (PPT, CSV, or XLSX) by clicking the Generate Report button and selecting the desired type.

• The Overview Report is a PPT that provides an overview of user engagement, including summaries of the three services, user status distribution for training, phishing behavior (and breakdown by risk levels), comparison between training alignment and phishing behavior, participation in various services over time, and the Top 10 users leaderboard.
• The Completed Activities report allows the supervisor to view, for each user and each activity (Awareness modules and Channel episodes), information such as time spent, points earned, availability date, start date, and completion date. Data can also be downloaded for a specific time period.
• The Participation Level report provides a general overview of users' training activity on the platform for Awareness and Channel services. For each user, the report shows the training paths assigned to the company and, for each path, indicates how many activities have been completed out of the total released. It also includes the status of phishing simulations and overall alignment status.
• The Detailed Participation Level report focuses on a single training path selected at the time of export. For each user, you can see which specific content has been completed or not, and the overall alignment status compared to the expected progression.
• The User Leaderboard report allows the supervisor to view detailed information for all users, their team, their leaderboard position, accumulated points, and earned badges.
• The Team Leaderboard report analyzes each team's position in the leaderboard, points, and associated badges.
• The Additional Content report provides the same information as the "Completed Activities" report but exclusively for additional content (cyber pills).
• The Individual Championship report can be downloaded for a specific championship and contains: participant's position, accumulated points (excluding phishing points), and earned badges.
• The Team Championship report can be downloaded for a specific championship and shows the leaderboard position of teams and their scores.

User Distribution by Service (Donut Chart)

This chart includes both Awareness/Channel statuses (inner ring) and phishing-related behaviors (outer ring), providing a more complete view.

Training Path Alignment Status (first ring)

• On track: users who have completed all activities or are behind by no more than 2 activities compared to those released.
• Regular: users who are behind by 3–5 activities compared to those released.
• Not regular: users who are behind by more than 5 activities compared to those released.
• Inactive: users who have not yet viewed the Privacy Policy.

Phishing Status (outer ring)

This data is updated based on the most recent regular campaign completed (remediation campaigns are not included). Users can be classified as:

• Weak: tends to click very frequently (at least 4 out of 5 campaigns received). 0.61 < click_rate ≤ 1
• Intermediate: clicks at a moderate frequency (at least 2 out of 5 campaigns). 0.21 < click_rate ≤ 0.61
• Strong: has clicked at least once in the past, but has since reduced the frequency (less than once every 5 campaigns). 0 < click_rate ≤ 0.21
• Cyber Defender: actively identifies phishing emails and uses the reporting feature. Must have reported the last campaign without clicking in the last five. Only available when the reporting feature is active.
• N.A.: has not received phishing emails in the last 5 campaigns or does not have a phishing license.

On the left, you can see:

• Total users on the platform: includes users who are not deleted, not suspended, and have an active or grace period license (for any service).
• Total number of teams (if any).

On the right, you'll find the numbers for user distribution by training path alignment status and by phishing status.

This chart is updated daily.

⚠️ Why might the numbers in the Overview differ from the service-specific tabs?

The "Total Users" count in Overview includes users with any active license, not just Awareness or Channel. This means users with a Phishing, PhishPro, Cyber Advisor, or any other active or grace period service license are included—as long as they are not deleted or suspended.

The Report Awareness and Report Channel tabs, on the other hand, show only users with the specific license for that service.

Example: if a company has 1,000 users with an Awareness/Channel license and 179 users with only a Phishing license, the Overview will show 1,179 total users, while the Awareness and Channel dashboards will each show 1,000.

"Inactive" users in the Overview are users who have not yet viewed the Privacy Policy, but who are not deleted, not suspended, and have at least one active or grace period license (for any service). For this reason, the number of inactive users in the Overview does not necessarily match the sum of inactive users in the individual Awareness and Channel tabs: those users may only have a Phishing license, so they do not appear in either service tab, but are still counted in the Overview.

Users with an assigned path but no active license for the corresponding service

It may happen that some users still have an Awareness or Channel path assigned, but no longer have an active license for those services (for example, because the license was removed after the path was assigned). In this case:

• The user does not appear in the Awareness or Channel dashboards, as they lack the relevant license.
• The user may appear in the Overview if they still have an active license for another service (e.g., Phishing).
• The path remains assigned as a leftover, but does not generate training activity or impact the statistics for those services.

If you find users in this situation, it's a good idea to check with your company contact whether to remove orphaned paths or restore the missing licenses.

Leaderboard

The leaderboard can be viewed for:

• All users in the company
• All teams in the company

When viewing all users, you can also filter by Team and by Championship. When viewing all teams, you can filter by championship.

If the Cyber Guru Phishing service is active, two colored symbols are shown next to each user in the leaderboard: one represents their training path alignment status, the other indicates their phishing status.

This chart is updated daily.

Report Awareness

In the Report Awareness section, the supervisor has access to all data related to user participation in the Awareness training course.

This section contains the following widgets:

• User Numbers
• User distribution by participation status
• Time spent per activity in minutes
• Points earned per activity
• Bulk download certificates for users who have completed a specific level

All charts are updated daily.

Data can be filtered: the filter applies to all widgets in the section and to downloadable reports.

User Numbers

The first widget at the top left shows information about the total users in the company and total teams. The count includes only users with an active Awareness license.

In the donut chart, the supervisor will see the distribution of users based on their level of participation in Awareness modules:

• On track: completed all activities or behind by no more than 2.
• Regular: behind by 3–5 activities.
• Not regular: behind by more than 5 activities.
• Inactive: have not yet viewed the Privacy Policy.

Time spent per activity in minutes

The supervisor can see the time users spent on each module in minutes. The first bar in the chart represents the actual duration of the activity, while the bar next to it shows the average time spent by users.

Points earned per activity

The chart shows the points associated with each activity and the average points earned by users for each module.

Available Reports (Generate "Awareness" report)

• The Awareness Report PPT shows the distribution of users in the Awareness service based on their progress, displaying the total time (in minutes) spent on each activity and the points earned for each module.
• The Completed Awareness Activities report shows, for each module, the time spent, points earned, availability date, start date, and completion date. Downloadable for a specific time period.
• The Awareness Participation report shows, for each participant, the modules viewed, their alignment status with the learning path, and their phishing status.
• The Participation report lets you view each user's course alignment status and the content released and completed. THIS REPORT IS BEING PHASED OUT.
• The Participation Level report provides an overview of training activity for the Awareness service, including learning paths, completed/total activities, phishing status, and overall alignment status.
• The Detailed Participation Level report focuses on a single Awareness path: for each user, you can see which content has been completed or not, and their overall alignment status.
• The Attempts per Activity report contains detailed information on user progress: activity performed, lesson, test question, correct answer and given answer, result, and time spent. Downloadable for a specific time period.

Bulk Download Certificates

In the Awareness Report section, a user with the Supervisor role can bulk download certificates for users who have completed the selected level.

The certificate export also includes certificates for users who are in a suspended status, as long as they have completed the specific level for which the export is requested.

If there are no users who have completed the selected level, the system will display a yellow informational banner indicating that no certificates are available.

Once started, the export is temporarily visible in the Download area, where you can monitor its progress:

• In progress: the file is still being generated.
• Available: the download is ready.

Channel Report

In the Channel Report tab, the supervisor has access to data on user participation in the Channel training course.

This section includes the following widgets:

• User numbers
• Distribution of users by participation status
• Time spent on the activity in minutes

All charts are updated daily.

User Numbers

The count includes only users with an active Channel license. The distribution is similar to that described for Awareness (On track, Regular, Irregular, Inactive).

Time spent on the activity in minutes

The supervisor can view the time users spent on each episode in minutes. The first bar represents the actual duration of the activity, the bar next to it shows the average time.

Available Reports (Generate "Channel" Report)

• The Channel Report PPT shows the distribution of users in the Channel service, displaying the total time spent on each episode.
• The Completed Channel Activities report shows, for each episode, the time spent, availability date, start date, and completion date. Downloadable for a specific time period.
• The Channel Participation report shows, for each participant, the episodes viewed and their status in the training program and phishing. THIS REPORT IS BEING PHASED OUT.
• The Participation Level report provides an overview of training activity for the Channel service, including learning paths, completed/total activities, phishing status, and overall alignment status.
• The Detailed Participation Level report focuses on a single Channel path: for each user, you can see which content has been completed or not, and their overall alignment status.

Phishing Report

In the Phishing Report section, you can find data related to simulated phishing attacks.

You can filter the data by clicking on Filters: you can select the campaign or "Organizations." The filter applies to all widgets and downloadable reports.

All data on this page is updated every day, every two hours, between 10:00 AM and 10:00 PM.

If no filter is selected, the data shown refers to the latest campaign.

Attack Information

You can view information about the attacks sent in the latest campaign and the click rate for the latest campaign.

Global Statistics

In the global statistics on the right, the data is cumulative and refers to all campaigns (including any ongoing campaigns).

Risk Evolution

The Risk Evolution bar chart lets you analyze the evolution of risk for each phishing campaign, showing the distribution of users based on their behavior. The data refers to only users who have interacted (clicked/reported) at least once.

Clickers per Campaign

The same chart (Risk Evolution) also lets you analyze the number of clicks per campaign. To view this chart, just click the three dots in the top right corner.

Weak Users

This widget shows how Weak Users behave across different campaigns.

Reliability Score

The Reliability Score chart measures the organization's resistance to attacks: it represents the number of attacks needed to "hit" the target. The higher the value, the better trained the users are and the less likely they are to click on malicious links.

Formula: (count(sent) - count(clicked)) / max(count(clicked), 1)

When you hover over a point on the chart, the tooltip shows:

Risk Distribution by Organization

The chart is based on the grouping criteria chosen by the company (Organizations). It is affected by the size of the groups: typically, a larger group shows a higher risk than a smaller one, even if the click rate is lower.

Click Rate by Device

The Click Rate by Device chart lets you analyze the click rate by device. By clicking the three dots, you can also analyze the data by operating system or browser.

Click Rate by Campaign

The Click Rate is the percentage of users who fell victim to the attack compared to the number of attacks sent in that campaign.

Click Rate by Organization

The Click Rate by Org shows the percentage of clicks compared to the number of attacks sent for each campaign, based on the grouping criteria chosen by the organization. The table highlights the most critical campaigns in red.

Click Rate by Template

The Click Rate by Template analyzes all templates (active and inactive). The report also includes absolute values, the number of times the template was used, and the total clicks received. The supervisor cannot preview the template.

Activity by Target

The Activity by Target table shows, for each user: their team, the absolute values of attacks sent and clicks made, whether the user clicked in the latest campaign, and their risk group (the Cyber Strength column). Depending on the organization's choices, the report can be shown either anonymized or with user names visible.

Risk Group (Cyber Strength column)

This column shows the same phishing behavior described in the “Phishing Status” of the User Distribution by Services widget (outer ring): only the label changes. The two naming conventions are equivalent:

⚠️ Pay attention to the calculation period. The risk group (Cyber Strength) is calculated only on the last 5 completed regular campaigns (remediation and ongoing campaigns are not counted). The “attacks sent” and “clicks made” columns in the same table, however, show cumulative values for all campaigns.

This is why the two data points may seem inconsistent: a user with only 1 click across many total campaigns may appear as Frequent/Intermediate if that click happened in the last 5 campaigns considered. The risk group therefore reflects recent behavior, not the overall history shown by the absolute values.

Available Reports (Generate "Phishing" Report)

In this section, you can export data for all campaigns or for specific campaigns. You can generate a PPT report or export global data in CSV format.

Discrepancies between CSV Report and Platform Charts

The CSV report also includes inactive users (identifiable by the "active" column with value 0), who are still classified as Strong Users. For this reason, the numbers in the CSV report may differ from the charts on the platform, which only consider active users.

Discrepancies in Click Rate Calculation between Platform and Report

The data in the platform charts (such as click rate) only consider the last 12 completed campaigns. In the CSV report, all completed campaigns over time are included. To reconcile any discrepancies, you need to manually filter only the last 12 campaigns in the CSV.

Remediation Report

In the Remediation Report tab, you can see data related to remediations.

Remediations can be of different types:

• Phishing-type Remediation
• USB Remediation (PhishPro)
• QR Code Remediation (PhishPro)
• Adaptive Remediation (PhishPro)
• Video Attack Remediation (PhishPro)

Remediation results are only visible once the remediation is complete.

By clicking on Details for a specific custom remediation (or a PhishPro attack), you can see the targets affected and the template(s) used. For classic remediations, you can view the results within the classic Phishing report.

By clicking on Report, you can generate a PPT with the remediation results; by clicking on Export, you can generate a zip file with all the details of user interactions with the remediation templates.