An employee can sometimes show as compromised in a Simulation campaign even though they did not fall for it. The most common case: the employee spotted the email and passed it on to your security team, who then analysed it in an automated tool. That tool clicked the link and entered credentials, and Riot attributed these actions to the employee.
This article explains why this status cannot be changed, and how to remove the attack from your campaign results.
1️⃣ Why the “compromised” status cannot be changed
As soon as an employee is marked as compromised on an attack, this status is final. It cannot be removed, and the attack cannot be turned into a report:
a report made after the compromise does not change the status;
the “Mark as reported” action is refused on an attack that is already compromised.
This rule ensures that your statistics reflect what actually happened at the time of the attack.
👍 Good to know: an email passed on to your security team through a channel other than Riot (an internal address, a ticket…) is not counted as a report. For the employee's good reflex to be recognised, the report must go through Riot.
2️⃣ Removing the attack from the campaign results
If you are certain that the employee did not take these actions, you can ignore the result of their attack. The attack is then excluded from the campaign statistics and from Smart Groups calculations.
👉 Step 1: open the relevant campaign, then click on the employee: the details of their attack open in a panel on the right.
👉 Step 2: click the “…” menu at the top right of this panel.
👉 Step 3: select “Ignore attack result”.
⚠️ Important: an ignored attack is counted neither as compromised nor as reported. It simply disappears from the results. It does, however, remain visible in the campaign's CSV export, which explains any difference between the export and the dashboard.
👉 Before ignoring an attack, check what happened
Open the employee's activity details: the timestamped timeline and the location of the actions often make it possible to recognise an automated tool (actions within a few seconds, from an unusual country or network). The signs to look for are detailed in Why employee activity on phishing emails in Riot doesn't look right ?
If in doubt, contact us via the chat, specifying the campaign and the employee concerned: we can help you check where the actions came from.
3️⃣ Preventing this from happening again
Riot automatically recognises and ignores the most common security scanners, but some tools behave exactly like a real browser and cannot be told apart from an employee. This is particularly true of analysis sandboxes, which open the page and fill in forms.
Ask your employees to report through Riot (report button or forwarding to the dedicated address) rather than through an internal channel: the report is then recognised.
Let your SOC or security team know: a simulation email does not need to be analysed in a sandbox. If the tool opens the link or enters credentials, it is the targeted employee who is marked as compromised.
Allow Riot in your security tools. For Microsoft 365, follow Configure Microsoft 365.
Key takeaways
The compromised status is final: it can neither be removed nor replaced by a report.
If the employee did not take these actions, ignore the attack result from the “…” menu: the attack is removed from the campaign statistics.
An ignored attack counts neither as compromised nor as reported.
For the good reflex to be recognised, reports must go through Riot, and simulation emails must not be analysed in a sandbox.