> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/human-security/phishing/custom-templates.md).

# Custom templates

Write your own phishing emails, with your own sender, content and attachments.

## Prerequisites

* The phishing admin permission (`canManageCyberTools`).
* The Phishing simulation is [set up](/human-security/phishing/setup.md).

## Create a custom template

{% stepper %}
{% step %}

### Open the template editor

1. Go to `Simulations` > `Templates` and click `Create a template`.
2. Start **From a pre-built template** (subject, sender and body are pre-filled, and you edit them) or **From scratch**.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FCZBzJ0Px5x63yWvawai4%2Fprotect-custom-template.png?alt=media&amp;token=ea0fba29-8376-4fe5-af99-65f0cc69161a" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Name the template

Give it an internal name (e.g. "Fake invoice Q2" or "IT password reset"). Employees never see it.
{% endstep %}

{% step %}

### Select the language

The template is only sent to employees whose language matches.

{% hint style="info" %}
One template = one language. To send the same scenario to French and English speakers, create one template in each language and add both to the same campaign.
{% endhint %}
{% endstep %}

{% step %}

### Configure the sender

* **From list**: select a pre-defined sender from Stoïk's list.
* **Custom**: enter a sender name and email address.

<details>

<summary>Tips for a realistic custom sender</summary>

* Use a sender name employees would trust, such as "IT Support", "Microsoft 365 Team", "HR Department", or the name of a real service your company uses.
* Use an address that looks plausible at first glance but contains subtle differences: for example `support@micros0ft-security.com` (zero instead of "o") or `noreply@1t-services.net` (digit instead of letter).
* Avoid obviously fake addresses: the goal is to train employees to spot small anomalies.

</details>
{% endstep %}

{% step %}

### Write the subject and the body

Enter the subject employees will see in their inbox, then write the content in the visual editor:

| Feature         | How to use                                                                                                                                                                                         |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Text formatting | Bold, italic, underline, text colour, alignment                                                                                                                                                    |
| Headings        | H1, H2, H3                                                                                                                                                                                         |
| Lists           | Bulleted and numbered lists                                                                                                                                                                        |
| Images          | Upload images (PNG, JPG). They can be resized and aligned                                                                                                                                          |
| Phishing link   | Use the link button in the toolbar to insert the phishing link. You must select a redirection page (e.g. Adobe, Microsoft, Google): this is the fake landing page employees will see if they click |
| Variables       | Type `$` in the editor to insert a dynamic variable                                                                                                                                                |

{% hint style="warning" %}
Every custom template must contain at least one phishing link. The editor shows an error if it is missing.
{% endhint %}

Variables are replaced with real data when the email is sent:

| Variable           | Description              |
| ------------------ | ------------------------ |
| First name         | Employee's first name    |
| Last name          | Employee's last name     |
| Full name          | Employee's full name     |
| Email              | Employee's email address |
| Coworker name      | A colleague's name       |
| Day / Month / Year | Current date components  |
| {% endstep %}      |                          |

{% step %}

### Add attachments (optional)

Reproduce attachment-based phishing (fake invoice, HR letter, shared document):

1. In `Attachments`, below the email body, drag and drop your files or click **Select files**.
2. Click the bin icon to remove a file.

Up to 5 files per template, 10 MB each. Attachments are sent with every simulation that uses the template, and show in the preview and in campaign results.

<figure><img src="https://2582414397-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FaDGGQ49Oui29Ft0kJjSm%2Fuploads%2FajuE24q6rK9ljkfPtKBr%2FScreenshot%202026-06-05%20at%2017.44.45.png?alt=media&amp;token=ca74ad56-49d3-41f9-90ed-66696a81a353" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Preview and save

Click `Send me a preview` to receive a test email, then click `Save`. The template is immediately available when creating campaigns.
{% endstep %}
{% endstepper %}

To generate a template with AI, see [AI phishing templates](/human-security/advanced/ai-templates.md).

## Edit a template

1. Go to `Simulations` > `Templates`.
2. Click the template, make your changes and click `Save`.

{% hint style="warning" %}
A template that has been used in a campaign (active or past) becomes read-only to preserve the results. To change it, create a new template.
{% endhint %}

## Archive a template

1. Go to `Simulations` > `Templates`.
2. Open the template menu, click `Archive` and confirm.

The template is removed from the library, from the campaign creation page and from any active campaign. Past results that reference it stay intact. Archiving is permanent: to reuse the content, create a new template.

## Search templates

Use the search bar at the top of the `Templates` tab to find a template by name.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/human-security/phishing/custom-templates.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.