Skip to main content
The people you test are contacts. Each one needs a name, a phone number, a role and a consent record. Without consent, a person is left out of every campaign.
Before you start: you need written authorisation to test these people. Calls go to your own staff only. See Before you test anyone.

Before you start

  • A list of your own staff with phone numbers in international format, for example +44 7700 900123.
  • Their consent to security testing calls, and how it was given.
  • Departments and tags you want to filter by later. Groups are tags; there is no separate group.

Steps: add one person

1

Open People

On the Red Team tab choose the People segment and click Open people. The page is titled Contacts. Click Add Contact.
2

Fill in Basic Information

Name, Role and Phone Number are required. Add an Email so the person gets a short training note after a call they fail, when coaching is on. Department, Location and Manager are optional. The manager is picked from your other contacts.
3

Record consent

Under TCPA Consent & Compliance, switch on “Contact has provided consent for security testing calls”. Then set Consent Scope, Consent Method and, if useful, Consent Details.
4

Allow help desk impersonation, if you run help desk tests

Switch on Can be impersonated in help desk tests to let a test use this person’s name, department and manager when it rings your help desk. The person is not phoned in a help desk test; only your help desk is.
5

Set a call window and tags, then save

Earliest Call Time and Latest Call Time default to office hours; pick a Timezone. Under Tags, type a tag and press Enter. Save the contact.

Steps: import a CSV

1

Click Import

On the Contacts page click Import. A window opens with a drop area, “Drop your CSV file here” or “click to browse”, and a Download Template button.
2

Prepare the file

The first line is the header. The import accepts this header, in this order:
The window lists the rules under CSV Format Requirements: required columns name, phone, role; optional columns email, department, location, tags; phone with the country code.
3

Drop the file and check the preview

The window shows Preview (First 5 rows). Rows missing a name, phone or role are skipped. Read the note TCPA Compliance Required: by importing, you confirm that consent has been obtained for every person in the file.
4

Import

When it finishes you see Import Complete with the counts. Any rows that failed are listed under Import Errors.

An example file

Keep one tag per person in the file. Add more tags on the contact afterwards.

Every column and field

Filters

The search box reads “Search by name, email, phone, or role…”. Next to it are filters for Department, Tags and Risk Level, and lists for TCPA Status (consented, not consented, opted out), Phone Status (Verified, Unverified), Status (Active, Inactive), Email (Has Email, No Email) and Campaign History (Has Participated, Never Contacted).

What “TCPA” means in the wizard

On the Authorise and launch step the wizard shows TCPA Consented with the number of people who will be called. If some of the people you picked have no consent, it shows “[n] contacts excluded” and “These contacts will not be called due to missing TCPA consent.” Fix the consent on the contact and come back.

What happens next

Pick the people on the Who is called step of a campaign. Fair testing rules may hold or skip a person; see Fair testing rules. For research on a person before a call, click Research this contact (OSINT) when editing them.

Problems

The header must contain name, phone and role, spelt exactly like that. Download the template from the window and paste your rows under its header.
The file must be a .csv. Export from your spreadsheet as CSV, not as .xlsx or .numbers.
A row is skipped when it has fewer values than the header, or when name, phone or role is empty. A comma inside a value also shifts the columns, so keep values free of commas.
Check three things: the consent switch is on, Opt-Out Status is off, and they are not in Excluded people under Fair testing rules.