What's New

You now have more control over when your recurring phishing simulations run.

New scheduling options

When you set up a recurring phishing simulation, you can now choose a Quarterly or Custom schedule. This lets you plan simulations around your organisation’s needs.

See when each simulation will send

While you’re scheduling, you’ll see exactly when each simulation will go out, including the date window and delivery time for every run. This makes it easier to check your schedule before you publish.

Find out more
For step-by-step guidance, see our updated article: How to Create and Publish a Recurring Phish Simulation

Reporting a phishing simulation should feel rewarding. You can now send users a short thank-you email the moment they report a simulation, reinforcing good reporting habits and building confidence in the Report button.

This is especially useful if your users report with the Microsoft Report button, as it now gives them confirmation that they’ve reported a simulation.

Key highlights:

• Works with the MetaCompliance report buttons and the Microsoft Report button
• Sent in the user’s preferred language, falling back to English if there’s no translation
• Customise the subject and body in Email Templates to suit your organisation
• Sent from your custom email sending address, if you’ve set one

The new setting, Send Phishing Report Confirmation Emails, is available now. It’s switched off by default, so go to Settings > Company Edit to turn it on. View More.

You can now add your own custom questions to the Question Bank, alongside hundreds of curated cyber security questions, and use them in course quizzes and learning pathway assessments.

What’s new:

• Question types – single choice or multiple choice.
• Categories – link each question to an existing category.
• Instant availability – available to all admins in your platform as soon as you publish.
• Translations – add translations to use a question in more than one language.

What hasn’t changed

Curated questions are unchanged and can still be edited within the course creation area.

Getting started

In the Question Bank area, select Add new question, enter your question and answers, then select Publish question. View more.

Now rolling out to all learning customers, Learning Pathways automatically assign each user the course that best suits their learning level. Users complete a short assessment and then matched to a course based on their score, so training feels relevant to them.

What’s new:

• Assessment-based assignment – build an assessment from the Question Bank, then link score ranges to your courses.
• Smart Path (optional) – add a question such as ‘What is your department?’. Depending on the answer, users can skip the assessment and go straight to a course, or complete it and be directed by both their answer and score.
• Flexible delivery – launch in MyCompliance, or export as a SCORM package for your own LMS.
• Reporting – track completion, assessment results and assigned courses in MyCompliance.

A pathway can include up to 30 courses and 30 assessment questions, and can be created in up to 46 languages.

Getting started

Create your course templates, then set up your pathway. View more.

We’ve upgraded Virtual Presenter with next-generation avatar technology, bringing noticeably more realistic facial expressions, lip sync, and overall presenter quality to your generated videos.

What’s new:

• Upgraded avatars only – we’ve retired older avatar styles from the selection screen so every video you create starts from our highest-quality option. Any videos you’ve already created are unaffected.
• Full-body avatars – choose between head-and-shoulders or full-body framing, depending on the style of content you’re creating.
• Refreshed avatar picker – easier to browse and select from the new, curated avatar library.

Getting started
Head to Virtual Presenter and select an avatar as usual, you’ll now see the updated avatar library with both framing options available where supported. View more.

It’s now possible to enable Teams Notifications for Course, Survey, Policy, and Phish Remediation Campaign Steps.

There’s a Send notification in Teams option available in the Notification settings for each campaign step and the Phish Remediation settings.

When you’re creating/publishing a Course, Survey or Policy, if you’re looking for the Teams, Slack or Email notification options, we’ve brought these all together under a new Notifications tab.

Read more about Teams Notifications here.

As part of our ongoing commitment to transparency, we’ve made two small updates:

• Course details now include a short note where AI has supported content creation.
• Virtual Presenter videos are labelled as AI-generated.

This aligns with EU AI Act transparency requirements and doesn’t change how your content is reviewed, managed, or delivered.

Employees can now report suspicious emails directly from Outlook using Microsoft’s native Report Phishing button — no plugin, no extra training, no friction. Reports flow straight into MetaCompliance, giving your security team instant visibility.

Setup takes minutes via a simple mail flow rule, and works out of the box in every language Outlook supports.

Find out more

We’ve made a small change to the course and phish creation flows to save admins a step. If your organization has Risk Scoring enabled, the “Enable Risk Score” option on new courses and phish is now enabled by default, so new content automatically feeds into your users’ risk profiles without any action needed.

If a particular course or phish shouldn’t contribute, you can still uncheck the option before publishing. Existing courses and phish are unaffected – this applies only to new content created from now on. View more.

You can now configure your phishing simulations to automatically redirect learners to any URL the moment they acknowledge the Learning Experience / Red Flag Learning Experience – routing them seamlessly into the next stage of your awareness programme without any manual intervention.

What’s new

• URL Redirect configuration. A new Redirect URL section is available within your phish Simulation settings. Toggle on Enable Redirect, enter your destination URL, and save as normal.
• Fires at the end of the learner journey. The redirect only triggers after the Learning Experience / Red Flag Learning Experience has been acknowledged, ensuring awareness messaging is always delivered first.
• Flexible destination. Point learners to an external LMS, a training course, a password reset portal, a policy acknowledgement page, or any other URL relevant to your programme.

What hasn’t changed

The Learning Experience / Red Flag Learning Experience itself is unchanged – the redirect simply adds an optional next step after it. If no redirect is configured, simulations continue to end as normal. View more.

We’ve made the Learning Overview report faster and easier to work with, especially for customers with large datasets.

What’s new

• Improved performance. The report now loads faster and more reliably, with no changes to the underlying data or functionality.
• New filter panel. Click the “Filter” button to open a side panel containing all available filter options. Apply filters to focus on the data you need.
• Export-friendly time formatting. Time data is now exported in figures, making it easier to sort and order in your spreadsheet tool of choice.

What hasn’t changed

The report itself, the data it contains, and the way it’s accessed are all unchanged. If you’re not exporting or filtering large datasets, you’ll notice the performance improvement and nothing else. View more.

Get clearer insight into phishing simulation performance across your organisation — without compromising on user privacy.

A new setting in Company Edit gives you the option to include department-level data in phishing reports when Anonymous Responses are enabled. User-level identifiers stay fully anonymised, and small departments are automatically protected via a configurable threshold.

Key highlights:

• Privacy-first by default — Department-Level Reporting is OFF unless you opt in
• Department visibility, user privacy — see trends by team without identifying anyone
• Automatic small-team protection — set a minimum department size; smaller groups stay anonymised
• Configured once, applied everywhere — consistent privacy behaviour across all campaigns, past and future

For more information about Department-Level reporting, check out the knowledgebase article here.