Sometimes the activity shown on a Simulation campaign looks odd: bursts of opens or clicks, abnormally high rates, or an employee who assures you they never clicked even though Riot says otherwise.
In the vast majority of cases, it wasn't your employees who acted, but a security scanner.
1️⃣ Why security scanners skew activity
Many companies use security tools (for example Microsoft Defender Safe Links) that automatically open emails and click their links to check them, before the employee even sees them. These scanners:
open emails to analyse them;
click links to check where they lead;
can interact with a simulation's login page.
If these actions were counted as your employees' actions, your open and click rates would look higher than they really are.
2️⃣ What Riot does now
Riot recognises these security scanners and ignores their activity. In practice:
since 13 September 2026, scanners receive a blank page and nothing is recorded;
since 23 September 2026, Microsoft Defender checks are filtered out, while genuine opens in Outlook are still counted.
Riot also hides the simulated login page from these scanners, which reduces the risk of our domains being flagged as suspicious.
👍 Good to know: if you are a Microsoft 365 customer, your \"Opened\" and \"Clicked\" rates drop from mid-September 2026. This is normal: the new figures are closer to reality. The results of your past campaigns are not changed.
⚠️ Important: keep allowing Riot in Microsoft 365. Microsoft can change how its scanners behave at any time: allowlisting remains the most reliable configuration. See Configure Microsoft 365.
3️⃣ If suspicious activity still appears
A scanner can still slip through, for example if a tool changes its behaviour. Here is what typical scanner activity looks like:
Here, the email was opened several times and its link clicked several times. Another common sign: the employee's location changing country within the same day.
👉 Signals to look out for
near-instant clicks or opens, within seconds of sending;
identical or repetitive behaviour across many employees;
actions coming from unusual IP addresses or outside your working hours;
open rates far higher than your usual campaigns.
👉 What should you do?
Look at the detailed activity of each employee concerned rather than the overall rates.
Check that Riot is allowed in your mailbox and in your security tools.
If the anomaly persists, contact us via the chat, stating the campaign name and the employees concerned.
Key takeaways
Security scanners open emails and click links before your employees do.
Since September 2026, Riot recognises these scanners and ignores their activity.
Microsoft 365 customers will therefore see lower, and more accurate, "Opened" and "Clicked" rates from mid-September.
Allowing Riot in Microsoft 365 remains essential.