Cyber awareness · Integrations
Fits into the environment you already run
An awareness program touches your directory, your mail flow, your security tooling and your employees’ personal data. Here is how the platform connects to each, and what your security team will want to check before it does.
Where the user list comes from
Microsoft Entra ID
Imports users and groups and synchronizes them daily, so joiners and leavers look after themselves.
LDAP / Active Directory
Imports whole organizational units, or groups built with your own LDAP query, on a schedule. The manager hierarchy can be read from it for manager reports.
CSV
Bulk import as a full sync, as add-only, or as "create a group from this file". A scheduled export from HR is enough to keep the list current.
Manual
Individual users, with custom fields for anything specific to your organization.
Each person’s preferred language is held with their record, so campaigns, training and notifications all reach them in it.
Google Workspace is supported for mail delivery and the report button, not for directory synchronization — a Google organization keeps its user list current by CSV or LDAP.
Roles narrow enough to hand out
- Single sign-on through ADFS, alongside local accounts with an enforceable password policy
- Roles for administrator, manager, auditor (read-only review), standard user, Academy learner and API access
- Custom roles with exactly the permissions you define, so nobody needs an administrator account to read a report
- A configurable access-token lifetime
Getting a simulation into an inbox without opening a hole
Your own sending infrastructure
Separate SMTP servers for simulation mail and system mail, each testable before use.
Direct delivery through Microsoft Graph
For Microsoft 365 tenants, simulations are placed straight into internal mailboxes, which avoids mail-flow exceptions for internal recipients altogether.
Narrow allow-listing
Where mail flow is used, we configure Microsoft’s advanced delivery policy for phishing simulations: named domains, sending addresses and simulation URLs only, never a tenant-wide exception.
Delivery tracking
Every message’s status — sent, queued, pending or failed, with the error — is visible, which makes "nobody received it" a five-minute question.
Events where your analysts already look
- Platform audit events to one or more Syslog collectors over TCP, UDP or TLS, in JSON, CEF or LEEF
- With phishing investigation, malicious indicators can be pushed into your security controls and SOAR workflows — Trend Micro Apex One and Apex Central, FortiMail and pfSense — to log or to block, with incidents forwarded to Syslog
- Investigation draws on VirusTotal, MetaDefender, Spamhaus and AlienVault OTX, among other sources
What the platform holds about your people
Encrypted user data
Personal data can be stored encrypted in the database.
Audit log
Sign-ins, successful and failed, user changes and campaign events, each with actor, address and time.
Data minimization in simulations
For credential-capture tests you choose to store nothing, only non-sensitive fields, or masked entries graded by strength. Passwords are never kept in usable form.
Opt-outs and anonymity
Exclude named people from simulations, other mailings or both, with a recorded reason; and run surveys anonymously when honesty matters more than attribution.
The platform is hosted and operated by Spirity, inside the EU. On-premises deployment is available for regulated clients.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
An app registration in your tenant with admin consent. For awareness alone that is directory read access, enough to synchronize users and groups.
If you also use direct delivery, or Phishing Investigation, it needs mailbox permissions as well — tenant-wide read and write. That is what allows a simulation to be placed into an inbox, and a real phishing email to be removed from every inbox that received it rather than only the reporter’s. We go through the permission list with your security team before anything is consented, because it is a reasonable thing to want explained.
Yes. CSV import supports a full synchronization, which removes people who are no longer in the file, so a scheduled export from your HR system is enough on its own.
Directory sync is less work over the year and keeps joiners and leavers current without anyone thinking about it, but it is not a requirement.
Yes. Audit events are forwarded over Syslog in JSON, CEF or LEEF, over TCP, UDP or TLS, to as many collectors as you configure. With Phishing Investigation, incidents and the actions taken on them can be forwarded as well, in summary or in full.
Where to go next
Phishing Investigation
A report button, our analysts, and removal from every mailbox that got it.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.