Managing Users and Groups in GoPhish Cloud

User groups define who receives your phishing simulations. This guide covers importing users, organizing groups, and best practices for targeting.

Creating a User Group

1. Navigate to Users & Groups in the sidebar.
2. Click New Group.
3. Enter a Group Name (e.g., “Engineering Team”, “All Staff Q2 2025”).

Adding Users

You can add users individually or in bulk.

Manual Entry

Click Add User and fill in the fields:

Field	Required	Description
First Name	Yes	Used in template variables {{.FirstName}}
Last Name	Yes	Used in template variables {{.LastName}}
Email	Yes	Delivery address
Position	No	Job title, used in {{.Position}}

Bulk Import via CSV

1. Click Bulk Import Users.

2. Upload a CSV file with the following columns:

   First Name,Last Name,Email,Position
   John,Smith,john.smith@example.com,IT Manager
   Jane,Doe,jane.doe@example.com,Developer
   

3. GoPhish will parse the CSV and add all users to the group.

Tip: Export a user list from your HR system, Active Directory, or Google Workspace admin console to quickly populate groups.

Organizing Groups Effectively

By Department

Create separate groups for each department (Engineering, Sales, Finance, HR). This allows you to: - Customize phishing scenarios to match each team’s daily workflow. - Compare click rates across departments to identify teams needing more training. - Stagger campaigns so your email server isn’t overwhelmed.

By Risk Level

After running initial campaigns, create groups based on results: - High risk — users who clicked links or submitted data. - Low risk — users who reported the phishing email. - Run more frequent or more sophisticated simulations for high-risk groups.

By Campaign Wave

For large organizations, split all-staff campaigns into waves of 50-100 users. This avoids spam filter triggers and provides more manageable result sets.

Updating and Reusing Groups

• Edit any group to add or remove users before launching a new campaign.
• The same group can be used across multiple campaigns.
• Deleting a group does not affect historical campaign results — those are preserved.

Troubleshooting

CSV import fails Ensure the CSV uses UTF-8 encoding and the header row matches exactly: First Name,Last Name,Email,Position. Remove any blank rows at the end of the file.

Duplicate email addresses GoPhish allows the same email in multiple groups but will only send one email per address per campaign. If a user appears in multiple selected groups, they receive the email once.

Large group imports are slow For groups with 1,000+ users, the import may take a few seconds. Do not navigate away from the page until the import completes.

---

Still need help? Open a ticket at support.hailbytes.com.