Skip to main content
No campaign calls anyone until a named person has authorised it. The last wizard step records who that is. The server checks the record again at launch, so a campaign saved without it stays a draft.
The person you name is accountable for the test. Read Before you test anyone first if you are not sure who that should be.

​
Before you start

  • A campaign on its last wizard step, Authorise and launch, or an existing draft open on its campaign page.
  • The authoriser’s full name, email and your engagement, ticket or statement of work reference.

​
Steps

1

Name the campaign

Under Name this campaign, the Campaign name is prefilled as the attacker’s name and today’s date. Change it if you like, up to 100 characters. The Note is optional and is not a script.Advanced: send results to a webhook reveals a Webhook URL field. Each call result is posted there, HTTPS only. Most teams leave it closed.
2

Check the summary

Read the cards before you sign: Schedule Configuration, Target Audience (people selected and how many have consent), Who calls, and Cost Estimation. If something is wrong, click the step name at the top to go back.
3

Record the authorisation

Under Launch Confirmation, the amber block Engagement authorization reads: Vishing calls may only be placed against targets you are explicitly authorized to test. This record is stored with the campaign for audit.Then tick the two confirmation boxes below the block. The first says you understand automated calls will be placed to the selected people and the rules have been followed. The second says you have reviewed the settings and understand a launched campaign cannot be modified.
4

Tick the extra scope boxes for your campaign kind

Some kinds need one more tick. The Launch button stays grey until it is done.For the help desk note, the placeholder shows the form: IT service desk on +44 20 7946 0000, agreed with the Head of IT on 3 October.
5

Launch

Click Launch. If a step is still incomplete, the wizard jumps to it and tells you what is missing, for example Confirm the authorisation before launching.

​
What happens next

The authorisation is stored with the campaign, stamped with the account that recorded it and the time. The launch is logged with who pressed it. Calls then start on the schedule you set. On the campaign page, the Authorisation card shows the record. While the campaign is a draft, Change lets you edit it. The card’s fields are Authorised by (full name), Their email and Reference (engagement, ticket or statement of work, optional), with two ticks: The people on this campaign are our own staff and this test is authorised and lawful. and I understand real phone calls will be placed in a cloned voice to the people listed. Press Record authorisation to save.

​
Problems

The reasons sit next to the button under Before launch:. They are one or more of: Choose an attacker., Pick a campaign template or write the script for this campaign., Add at least one person to call., Set an opening line., Record the authorisation. When all are fixed it reads Ready to launch.
The server message reads: Campaign is not authorized. Complete the engagement authorization (authorizer name, email, and scope confirmation) before launching. Fill in the Authorisation card on the campaign page and press Record authorisation.
The person whose cloned voice this campaign uses withdrew consent. Choose another attacker, or edit the attacker and pick another voice. See Clone an executive’s voice with consent.
Open the campaign and add an Opening line, or pick a template, under the attacker card. Then press Launch again.