Third-party simulation tools

How to exempt phishing simulation emails from Material Security

If you use third-party phishing simulation tools like KnowBe4, Ninjio, or Microsoft Attack Simulation Training, you may want Material Security to ignore those test emails. There are several ways to exempt simulation emails from Material's security checks.

Use Trusted Entities in most cases. Use a custom header exemption when your simulation tool delivers through API or does not provide reliable IPs.

Method 1: Trusted Entities (Recommended for most cases)

The simplest approach is to add your simulation tool's IP addresses to your Trusted Entities list:

1. Create a new Trusted Entity.
2. For Entity type, choose External IP Addresses.

Trusted Entity Configuration Settings

Ignored Issues

• Ignore email threats from this entity: If toggled off, Material will continue to create email threat issues as usual regardless of trusted entity status. If toggled on, specify how to ignore the issues:

  • Create issue, but mark messages safe: Issues will be created for messages from the trusted entity, but they'll automatically be marked safe. This is useful if you still want to auto-apply response like reporter acknowledgements.
  • Don't create phishing issues: If enabled, any email threat detection (user reported, Material, etc.) will not match messages from the trusted entity. Any message from that trusted entity is also ineligible for matching and won't be included in auto threat hunt.

Email Authentication

DMARC is any of fail, permerror, temperror or SPF is any of fail, temperror , permerror, softfail, policy, fail or DKIM is any of fail, temperror, permerror, policy.

Do not trust messages that fail authentication: If messages fail authentication, even from a trusted entity, they're treated as untrusted.

Example:

Authentication results are considered in the comparison. This means that for an email to be considered a Trusted Entity match, the sender must match with the Trusted Entity, and the authentication results of the email must also pass.

For example, say you have a Trusted Entity at domain.com

• We receive an email from [e-mail] and email authentication failed.
• We compare [e-mail] with domain.com, then we also check if authentication passed. If it did pass, this is a Trusted Entity match, an issue is not created.

  • If authentication failed, this is not a Trusted Entity match and an issue is created.

---

Trust messages regardless of authentication: If email authentication fails, the detection doesn't consider this failed authentication as matching criteria and will trust the message. If you use other email security products, like gateway, choose this option.

Example:

In this case, the Trusted Entity match is determined solely by comparing the sender of the email to the trusted entity, regardless of the authentication results of the email.

For example, say you have a Trusted Entity at domain.com

• We receive an email from [e-mail] and email authentication failed.
• Because Trust messages regardless of authentication is enabled -- we only compare the domain of [e-mail] with domain.com which equals a Trusted Entity match; an issue is not created.

Vendor-specific notes

• Microsoft Attack Simulation Training: add simulation domains to Trusted Entities. Microsoft provides a list of domains used for attack simulations. If you know the sender email addresses before the campaign starts, you can add those specific addresses instead of all simulation domains.
• KnowBe4: Find relevant IP addresses in their whitelisting guide

Review Trusted Entities to learn more.

Method 2: Custom Header Exemption

For some simulation tools, IP allowlisting is not a reliable option. In those cases, Material can configure custom header exemptions on the backend. This method works well when:

• Your simulation tool allows you to add custom headers
• You're using API delivery methods, where IP addresses are not available

KnowBe4 simulations can be delivered through SMTP or API. If you use API, you must use a custom header.

To set this up:

1. Add a custom header to your simulation emails (e.g., X-YourCompany-Sim: your-unique-value). Both key and value can be anything, but must be static.
2. Contact Material Support to configure the exemption based on your custom header.

When you use custom headers, choose a unique value that you define yourself. Avoid default values provided by simulation tools, since attackers could potentially reuse those headers to bypass security.

Viewing Exempted Messages

Exempted simulation emails appear in Explorer > Messages with a Category of Exempt.