> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/email-threats/third-party-simulation-tools.md).

# Third-party simulation tools

## How to exempt phishing simulation emails from Material Security

If you use third-party phishing simulation tools like KnowBe4, Ninjio, or Microsoft Attack Simulation Training, you may want Material Security to ignore those test emails. There are several ways to exempt simulation emails from Material's security checks.

{% hint style="success" %}
Use **Trusted Entities** in most cases. Use a **custom header exemption** when your simulation tool delivers through API or does not provide reliable IPs.
{% endhint %}

### Method 1: Trusted Entities (Recommended for most cases) <a href="#method-1-trusted-entities-recommended-for-most-cases" id="method-1-trusted-entities-recommended-for-most-cases"></a>

The simplest approach is to add your simulation tool's IP addresses to your Trusted Entities list:

1. Create a [new Trusted Entity](/getting-started/fundamentals/detect/trusted-entities.md#view-existing-trusted-entities-and-add-new).
2. For Entity type, choose **External IP Addresses**.

#### Trusted Entity Configuration Settings <a href="#understanding-trusted-entity-configuration-options" id="understanding-trusted-entity-configuration-options"></a>

<details>

<summary><strong>Ignored Issues</strong></summary>

* **Ignore email threats from this entity**: If **toggled off**, Material will continue to create email threat issues as usual regardless of trusted entity status. If t**oggled on**, specify how to ignore the issues:
  * **Create issue, but mark messages safe**: Issues will be created for messages from the trusted entity, but they'll automatically be marked safe. This is useful if you still want to auto-apply response like [reporter acknowledgements](/learn-more/risk-areas/email-threats/auto-respond.md).
  * **Don't create phishing issues:** If enabled, any [email threat detection](/learn-more/risk-areas/email-threats.md) (user reported, Material, etc.) will not match messages from the trusted entity. Any message from that trusted entity is also ineligible for matching and won't be included in [auto threat hunt](/learn-more/risk-areas/email-threats/investigate/issue-details/detected-and-similar-messages.md#auto-threat-hunt-messages).

</details>

<details>

<summary><strong>Email Authentication</strong></summary>

{% hint style="info" %}
DMARC is any of `fail`, `permerror`, `temperror` or SPF is any of `fail`, `temperror` , `permerror`, `softfail`, `policy`, `fail` or DKIM is any of `fail`, `temperror`, `permerror`, `policy`.
{% endhint %}

**Do not trust messages that fail authentication**: If messages fail authentication, even from a trusted entity, they're treated as untrusted.

*Example*:

Authentication results **are** considered in the comparison. This means that for an email to be considered a Trusted Entity match, the sender must match with the Trusted Entity, **and** the authentication results of the email must also pass.

For example, say you have a Trusted Entity at [`domain.com`](http://domain.com/)

* We receive an email from [`abc@domain.com`](mailto:abc@domain.com) **and** email authentication failed.
* We compare [`abc@domain.com`](mailto:abc@domain.com) with [`domain.com`](http://domain.com/), then we also check if authentication passed. If it did **pass**, this **is** a Trusted Entity match, an **issue is not created**.
  * If authentication **failed**, this is **not** a Trusted Entity match and an **issue is created**.

***

**Trust messages regardless of authentication**: If email authentication fails, the detection doesn't consider this failed authentication as matching criteria and will trust the message. **If you use other email security products, like gateway, choose this option.**

*Example:*

In this case, the Trusted Entity match is determined solely by comparing the sender of the email to the trusted entity, regardless of the authentication results of the email.

For example, say you have a Trusted Entity at `domain.com`

* We receive an email from `abc@domain.com` and email authentication **failed.**
* Because **Trust messages regardless of authentication** is enabled -- we only compare the domain of `abc@domain.com` with `domain.com` which equals a Trusted Entity **match**; an issue is **not** created.

</details>

#### Vendor-specific notes

* **Microsoft Attack Simulation Training:** add simulation domains to Trusted Entities. Microsoft provides a list of domains used for attack simulations. If you know the sender email addresses before the campaign starts, you can add those specific addresses instead of all simulation domains.
* **KnowBe4:** Find relevant IP addresses in their [whitelisting guide](https://support.knowbe4.com/hc/en-us/articles/203645138-Whitelisting-Guide)

{% hint style="success" %}
Review [Trusted Entities](/getting-started/fundamentals/detect/trusted-entities.md) to learn more.
{% endhint %}

### Method 2: Custom Header Exemption <a href="#method-2-custom-header-exemption" id="method-2-custom-header-exemption"></a>

For some simulation tools, IP allowlisting is not a reliable option. In those cases, Material can configure custom header exemptions on the backend. This method works well when:

* Your simulation tool allows you to add custom headers
* You're using API delivery methods, where IP addresses are not available

{% hint style="info" %}
KnowBe4 simulations can be delivered through SMTP or API. If you use API, you must use a custom header.
{% endhint %}

To set this up:

1. Add a custom header to your simulation emails (e.g., `X-YourCompany-Sim: your-unique-value`). Both key and value can be anything, but must be static.
2. Contact Material Support to configure the exemption based on your custom header.

{% hint style="warning" %}
When you use custom headers, choose a unique value that you define yourself. Avoid default values provided by simulation tools, since attackers could potentially reuse those headers to bypass security.
{% endhint %}

### Viewing Exempted Messages <a href="#viewing-exempted-messages" id="viewing-exempted-messages"></a>

Exempted simulation emails appear in **Explorer** > **Messages** with a **Category** of **Exempt**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.material.security/learn-more/risk-areas/email-threats/third-party-simulation-tools.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.