What's New

As part of our ongoing commitment to transparency, we’ve made two small updates:

• Course details now include a short note where AI has supported content creation.
• Virtual Presenter videos are labelled as AI-generated.

This aligns with EU AI Act transparency requirements and doesn’t change how your content is reviewed, managed, or delivered.

Employees can now report suspicious emails directly from Outlook using Microsoft’s native Report Phishing button — no plugin, no extra training, no friction. Reports flow straight into MetaCompliance, giving your security team instant visibility.

Setup takes minutes via a simple mail flow rule, and works out of the box in every language Outlook supports.

Find out more

We’ve made a small change to the course and phish creation flows to save admins a step. If your organization has Risk Scoring enabled, the “Enable Risk Score” option on new courses and phish is now enabled by default, so new content automatically feeds into your users’ risk profiles without any action needed.

If a particular course or phish shouldn’t contribute, you can still uncheck the option before publishing. Existing courses and phish are unaffected – this applies only to new content created from now on. View more.

You can now configure your phishing simulations to automatically redirect learners to any URL the moment they acknowledge the Learning Experience / Red Flag Learning Experience – routing them seamlessly into the next stage of your awareness programme without any manual intervention.

What’s new

• URL Redirect configuration. A new Redirect URL section is available within your phish Simulation settings. Toggle on Enable Redirect, enter your destination URL, and save as normal.
• Fires at the end of the learner journey. The redirect only triggers after the Learning Experience / Red Flag Learning Experience has been acknowledged, ensuring awareness messaging is always delivered first.
• Flexible destination. Point learners to an external LMS, a training course, a password reset portal, a policy acknowledgement page, or any other URL relevant to your programme.

What hasn’t changed

The Learning Experience / Red Flag Learning Experience itself is unchanged – the redirect simply adds an optional next step after it. If no redirect is configured, simulations continue to end as normal. View more.

We’ve made the Learning Overview report faster and easier to work with, especially for customers with large datasets.

What’s new

• Improved performance. The report now loads faster and more reliably, with no changes to the underlying data or functionality.
• New filter panel. Click the “Filter” button to open a side panel containing all available filter options. Apply filters to focus on the data you need.
• Export-friendly time formatting. Time data is now exported in figures, making it easier to sort and order in your spreadsheet tool of choice.

What hasn’t changed

The report itself, the data it contains, and the way it’s accessed are all unchanged. If you’re not exporting or filtering large datasets, you’ll notice the performance improvement and nothing else. View more.

Get clearer insight into phishing simulation performance across your organisation — without compromising on user privacy.

A new setting in Company Edit gives you the option to include department-level data in phishing reports when Anonymous Responses are enabled. User-level identifiers stay fully anonymised, and small departments are automatically protected via a configurable threshold.

Key highlights:

• Privacy-first by default — Department-Level Reporting is OFF unless you opt in
• Department visibility, user privacy — see trends by team without identifying anyone
• Automatic small-team protection — set a minimum department size; smaller groups stay anonymised
• Configured once, applied everywhere — consistent privacy behaviour across all campaigns, past and future

For more information about Department-Level reporting, check out the knowledgebase article here.

We have introduced a new feature that allows you to reassign courses to end users at a custom interval after their initial completion, rather than the default 12‑month recurrence.

You can now define how many months after completion a course is automatically reassigned. This gives you greater flexibility to ensure users remain compliant and receive refresher training at a cadence that suits your organisation.

This update applies to both new and existing anniversary courses. View more.

We’ve introduced a new update within Virtual Presenter that makes it easier to perfect your videos before generation.

With Preview Audio, you can now hear how your selected avatar will deliver your script in advance. This allows you to refine your script, adjust wording, and experiment with voice styles until you’re happy with the final result.

Best of all, this is a preview feature – so you can test and iterate as much as needed without using any minutes.

Give it a try and create with confidence, knowing exactly how your content will sound before you generate it. View more.

Full release 26/05/2026

From May 2026, Phish reporting will handle users who are later deleted or disabled differently, ensuring historical campaign data remains accurate, stable, audit‑ready, and GDPR‑compliant as your user base changes over time.

A new setting is available in Company Edit and will be switched on by default for all customers – ensuring deleted and disabled user data is retained for all future phishing emails.

For more information about how this feature works and what data is retained, take a look at the knowledgebase article here.

A new date column has been introduced in the End User Course table on the MyCompliance site. This column indicates when the user was targeted with the course. The value will vary based on the course type:

• Standalone Course – Target date
• Anniversary Course – Initial date of the first occurrence
• Campaign Course (Pre-December 2025) – Date the user was added to the overall campaign
• Campaign Course (Post-December 2025) – Date the user was added to the specific campaign step

By default, the column displays the earliest date first, helping users identify when content is overdue.

Organisations are increasingly seeking protection from new digital threats. MetaCompliance now offers a fully customised Deepfake Awareness Course, with the option to include a bespoke deepfake of your CEO or leadership team.

The training shows how convincing deepfakes can be, helping employees spot red flags and act fast.
Give your teams the confidence to identify deepfakes. Enquire now to learn about costs and the creation process.

We’ve upgraded how campaigns send emails and target users to deliver better performance and reliability. These improvements reduce system strain and make campaigns run faster.

Rollout Completed on:

• Canada & US Data Centers: 20 Nov 2025
• UK & DACH Data Centers: 2 Dec 2025
• Ireland & Netherlands: 18 Dec 2025

Campaigns created after these dates use the new v2 version. The experience looks the same, but performance is significantly improved.

For more information, please click here.