Build 1208: AttackPhish exclusions, annual billing and CSV export

4th November 2026 | Autopilot Release Notes Build 1208: AttackPhish exclusions, annual billing and CSV export

This build brings AttackPhish result exclusions, annual billing for partners and a pile of HootPhish and reporting fixes.

New

  • Exclude activities, recipients or addresses from AttackPhish campaign results. Preview the impact first, give a reason, and restore anything later; Emails Reported now counts self reports only. AttackPhish
  • Export to CSV on the Phish Admin tables. Take the data into a spreadsheet in one click. AttackPhish
  • Partners can switch their subscription to annual billing. Annual billing is a prepaid seat block, with overage alerts and an option to buy more seats. Billing

Improved

  • The Lookalike domain report no longer lists the tenant’s own domains. You can also filter it to domains with an MX record. Reports
  • Cyber Security Summary reports now list exposures for accounts that aren’t in the system. You see the full picture, not just the accounts CyberHoot knows about. Dark Web
  • Custom Messaging previews show the tenant’s primary manager name and email. You see what recipients will see.
  • A clear billing error appears when Stripe refuses to add a Power-up to a partner’s subscription. You know why it didn’t go through. Power-ups
  • The seat count, term and Power-ups picked on the pricing page carry into Autopilot signup. No re-entering your choices.
  • HootPhish now says patented instead of patent-pending. HootPhish

Fixed

  • The HootPhish tutorial Next button works in translated pages, such as Slovak. Users no longer get stuck on the first step. HootPhish
  • HootPhish on mobile: the question no longer covers the email, and wide emails fit the screen. HootPhish
  • General compliance reporting no longer fails on responses with no group. Reports
  • A pushed-out training start date stays put. Later tenant saves no longer undo it.
  • Library policy templates download as Word files with the right name and file type.
  • Entra ID sync no longer runs with blank credentials. The tenant is marked as missing settings instead. Integrations
  • AttackPhish campaigns that closed with no per-recipient results are repaired. AttackPhish
  • The phishing summary report email keeps going if one recipient fails. The other recipients still get their report. Reports
  • The user dashboard no longer errors when the HootPoints card can’t find the customer record.
Latest Blogs

Stay sharp with the latest security insights

Discover and share the latest cybersecurity trends, tips and best practices – alongside new threats to watch out for.

Your Calendar Has an Uninvited Guest

Your Calendar Has an Uninvited Guest

Author: Katie Boquetti | Editorial: Craig Taylor Editorial by Craig Taylor: For years we've trained...

Read more
The Patented Phishing Test that Introduces Itself

The Patented Phishing Test that Introduces Itself

Most phishing tests lie to your employees. This one says hello first! HootPhish tells people up front: this is...

Read more
EMERGENCY ADVISORY: Critical PHP Flaws (“PHP2Shell”) Need Action Today

EMERGENCY ADVISORY: Critical PHP Flaws (“PHP2Shell”) Need Action Today

Severity: CRITICAL (CVSS 9.2) | Issued: October 22, 2026 On October 21, two critical flaws in PHP,...

Read more