Forum Discussion
ExMSW4319
Aug 22, 2021Iron Contributor
Feeding the Attack Simulator
Previous commentators have noted the simulator's tendency to send attacks in a single wave. This can lead to a comment from one recipient warning another. Additionally, the wave may overwhelm local I...
VasilMichev
Aug 22, 2021MVP
Ask and you shall receive: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/announcing-exciting-updates-to-attack-simulation-training/ba-p/2455961
- ExMSW4319Aug 24, 2021Iron ContributorVasil, that was exactly what I was looking for. I gave it a try and the Randomize Send Times feature did not work - everything arrived at the same time. I was using a single attack to a group of eight recipients over a short period of four days, which may have caused the random algorithm a problem. Does anyone know if there is documentation for the new feature beyond the June announcement, or am I better off speaking to Product Support?
- VasilMichevAug 24, 2021MVPOpening a support case wouldn't hurt.
- JR_TayschrennSep 23, 2021Brass ContributorI'd argue that opening a support case would hurt the sanity of anyone doing so.
I have yet to have a single Phishing Attack Simulator ticket NOT take weeks or months to resolve, and most result in outright changes to the entire product due to the abysmal QC Microsoft has shown with their O365 product suite in the past few years, and the attack simulator top among that.
There was a stretch of a month that it outright wouldn't load reports correctly on any browser including the newly GA Edge, and it took around 3 months for them to allow us to delete simulations that we ran as internal trial run/tests (hiding didn't remove them from the report metrics) - and 8 months later I'm still seeing metrics reporting deleted run clicks/trainings and trainings that are spamming users months later.
Support meanwhile likes to respond with a few days of gathering data you provided them in the initial email/ticket but have to explain 2-3 times in different ways, and then radio silence as they 'escalate' the issue to someone that doesn't communicate any form of helpful or even informational updates outside of 'we're working on this' or some shade of that.
I should make a post about this, come to think on it.