Everything you need to get started using Insight​

Training & Phishing Onboarding Instructions

Are you ready to begin the onboarding process for your staff’s new cybersecurity training courseware and phishing campaign? We’ve provided a series of simple steps you can follow to get your team started!

insight user list template

Insight Excel User Template

Download our Microsoft Excel template to format your user lists.

Course Introduction Email Templates

Provide your team with all the information they need to start their cybersecurity training in a single email! Simply download one of our introduction templates, fill in the blanks with your organization’s information, and send the document to your staff.


Cybersecurity Awareness Posters

Download our collection of professionally designed cybersecurity awareness posters for use in your workspace. Each poster combines bright visuals and useful tips to keep viewers mindful of cybersecurity best practices.

Frequently Asked Questions

Contact Information

John Bomba
Senior Security Engineer
Phone: 732.507.7341

Brian Lau
Phone: (609) 915-2758


Emails that come from our phishing campaigns may get blocked by your spam filters. To avoid this, please have your IT administrator whitelist the following domains so that the phishing emails sent can be delivered to target users throughout your organization.

The domains above are registered to:

Our main contact domain is registered to:

G Suite: Create and approved sender list: Click here for official G Suite Documentation

Microsoft office 365: Configure 3rd Party Phishing Simulations: Click here for official Microsoft documentation.
Please note: Microsoft does not recommend using transport rules for phishing simulations.


Our phishing simulations closely resemble emails that you receive on a regular basis. They are created to look very similar to those sent by large, well-known corporations (i.e., Google, Amazon, Chase, etc.).

New email templates are carefully created and selected for each client and phishing period. Factors such as the time of year, client type (i.e., town vs. school), and location are all taken into consideration when we design our simulations.

All URLs within our phishing simulation emails link to D2’s own training domains. Upon clicking one of these links, the victim is sent to a landing page site that provides education on how they could have identified the simulated phishing attempt and how to avoid clicking on potentially malicious URLs in the future.

Phishing simulations normally run for one to two weeks, Monday through Friday. 

Users that receive our simulated phishing emails will not be negatively impacted in any way.

No. We can only use an email address provided by your organization.

You can add/remove users (one at a time or in bulk) by uploading a list through our online portal here.

To ensure that all users receive the simulated phishing emails, please confirm that there are no typos on your list before submitting.

Please read this PDF for a detailed walkthrough. Click here to download.

Our phishing simulations are run four times a year, once per quarter.

D2 will always send you four test phishing simulations several days to a week in advance. The emails will be titled “D2 Cybersecurity Test”, and each will include a short message informing you of your upcoming campaign.

If you are still uncertain, please contact D2 for confirmation.

Follow your organization’s policies for reporting a phishing attack.

Do not click anything in the email message. 

Please contact D2 so that we may confirm the message’s legitimacy and help keep your school/municipality safe.

See our whitelisting FAQ

Gap Assessment

Vulnerability Assessment

No data will ever be downloaded or modified.

G Suite: Create and approved sender list: Click here for official G Suite Documentation

Microsoft office 365: Configure 3rd Party Phishing Simulations: Click here for official Microsoft documentation.
Please note: Microsoft does not recommend using transport rules for phishing simulations.

D2 will never install software on your systems during a vulnerability scan.

Vulnerability scans:

There may be rare instances where D2’s IP addresses will need to be whitelisted.

D2 will reach out to the technical POC if this becomes necessary.

Reach out to John Bomba to update your IP addresses.

John Bomba
Phone: 732-507-7341

Additional IP addresses can be added at any time.

Vulnerability scanning uses automated tools to detect vulnerabilities in your network. During this process, the vulnerabilities are only detected, not exploited to gain access/control.

Penetration testing is a manual process that involves exploiting vulnerabilities, emulating what a hacker might attempt in an effort to access and take control of your network.

Vulnerability scanning is usually completed in under an hour and is performed during off-hours to minimize the already small chance of it affecting your network.

We recommend that ALL IP addresses be tested. Including those which are thought to be unused.

One of our goals is to identify potentially forgotten internet connected devices that might compromise the security of your network.

The KYC form has a “Testing Window” section or you can email John Bomba to modify the time you initially indicated.

The KYC form has an “Exceptions” section. Reach out to John Bomba to update it, if needed.

Our advice is to scan every external IP address to detect any vulnerabilities. Leaving a critically important section of the network unscanned/tested might leave it vulnerable to a cyber-attack that could have otherwise been prevented.

D2 will NOT conduct a vulnerability scan on any interconnected systems.

D2 will NOT attempt to connect to any interconnected county, state, or federal systems.

Only the IP addresses listed on the KYC form will be included.

Reports will be available as downloadable PDF’s at

Your  report should be available the next business day after the scan is performed, usually the day after the KYC form is submitted.

No. Due to the sensitive nature of the information in the vulnerability reports they can only be access through the insight portal.

We strongly advise that you DO NOT share your Insight login credentials (or share credentials for any other systems that you might need to access).

If you would like to add more than two POCs, please either provide an additional copy of the KYC form that includes the additional users’ information or contact John Bomba.

Vulnerabilities are classified on a scale of Low, Medium, High, and Critical, based on their CVSS score.

In the event that we find a Critical vulnerability, D2 will notify the POCs within one business day.

This means that our scans did not detect any vulnerabilities at this time.

Please keep in mind that new vulnerabilities and exploits can be found daily, so you may see something appear on the next report.

If a vulnerability or exploit has been identified, D2 will include any known remediation steps within the report. We advise that you discuss these suggested solutions with your technology POCs.

Vulnerability Scanning and External Penetration Testing are conducted against your public IPs and domains. Please keep in mind the private IPs in the ranges listed below are not valid IPs for those services:

  • Class A: 10.0. 0.0 — 10.255. 255.255
  • Class B: 172.16. 0.0 — 172.31. 255.255
  • Class C: 192.168. 0.0 — 192.168. 255.255
Include the entire range. This will ensure if you add a host on to an IP in the future it will automatically be included in the scans and it will also ensure that if there are any “rogue” devices connected to your network the are similarly scanned.

Yes the firewall may still respond to certain queries and some vulnerabilities can still be detected. It’s important to verify that all security patches are up to date and configured properly. Vulnerability scanning can assist with that.

In general, any IP that is on the following list is a private IP used inside a network/firewall and not suitable/reachable for external scans:

  • 10.0. 0.0 to 10.255. 255.255
  • 172.16. 0.0 to 172.31. 255.255
  • 192.168. 0.0 to 192.168. 255.255

Please keep in mind there are others such as that are special addresses that would also be unacceptable for external vulnerability scanning. see

Penetration Testing

Course Reminder Email

Your organization has enrolled you in D2 Cybersecurity’s Cyber Awareness Education program, and you have not yet fully completed your courseware.

Please refer to the link provided near the bottom of your reminder email for issues logging in (Having issues logging in? Click here). This link will help you reset your password. If you continue to run into issues, please reach out to  to request a password reset, with the following information:

First Name:
Last Name:
Email Address that received the reminder email:

Once you have logged into your training account through the login link provided in your reminder email, you may view your course modules by clicking on “My courses” at the top of your screen. Both the course (SCORM Package) and Quiz must be completed to fully complete your courseware.