Security Policy Errors

What Does Compromised Mean in Microsoft Attack Simulation Training?

Huma Ashraf Ch Oct 12, 2026 869 views

Question details

The user wants to understand the exact definition and criteria for a "Compromised" result within Microsoft Defender's Attack Simulation Training.

What Does Compromised Mean in Microsoft Attack Simulation Training?

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Reviewing phishing simulation reports or participating in a simulated phishing campaign to measure security awareness.
Observed behavior: Users require clarity on how the simulation categorizes the submission of real versus fake credentials and what constitutes a compromised state.

Before you start

Before reviewing your simulation results, ensure you have appropriate administrator access to the Microsoft Defender portal to view user analytics safely.

Solution 1Recommended

Understanding the "Compromised" Status Criteria

A detailed breakdown of what triggers a compromised result during a simulated phishing campaign.

Microsoft Defender Attack Simulation Training utilizes harmless, simulated phishing emails to test employee awareness and measure organizational risk.

The 'Compromised' result specifically indicates that a targeted user clicked the simulated phishing link and proceeded to enter their actual account credentials into the simulated login page.

Analyze the User Interaction

Check the simulation report. A compromised status confirms the user reached the landing page and successfully submitted their real account credentials to the simulated form.

Identify Fake vs. Real Data Submission

If a user recognizes the phishing attempt but enters a fake password or sample phrase, their actual credentials are not compromised. However, the system may still record this as a dangerous interaction since data was submitted to an unverified source.

Review Assigned Remediation

Users who are flagged as compromised will typically be automatically assigned remedial training modules by the simulation policy to improve their future phishing detection skills.

Understanding the "Compromised" Status Criteria

Data Privacy During Simulations: Because this is an internal, safe simulation run by your organization, any submitted credentials are discarded immediately and are never captured, stored, or exposed to real threat actors.

Free Microsoft Office alternative

Enhance Document Security with WPS Office

While Microsoft Defender manages your organizational email security and attack simulations, you might be looking for a secure, offline-capable alternative to Microsoft Office. WPS Office provides a robust, lightweight document editing environment that keeps your sensitive data safely stored on your local device.

1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
2. Install the Software: Run the downloaded setup file and follow the straightforward on-screen instructions to complete the installation.
3. Open Your Documents Securely: Launch WPS Office and open your existing Microsoft Office files. Enjoy full local control over your documents without forced cloud synchronization.

Provides a highly secure document environment with offline mode and strong local file encryptionFully compatible with all major Microsoft Office formats including .docx, .xlsx, and .pptxLightweight software that runs efficiently on Windows, Mac, Linux, iOS, and AndroidFamiliar user interface ensuring seamless migration with zero learning curve

microsoft office alternative - wps office

Frequently Asked Questions

Can entering a fake password trigger a "Compromised" alert in Microsoft Defender?

Generally, the system attempts to detect if genuine credentials were submitted. However, any data entered into the simulated credential harvesting form proves the user fell for the lure, so they may still be marked as having interacted dangerously with the simulation.

Where can administrators see which users were compromised?

Admins can view detailed analytics by navigating to the Microsoft 365 Defender portal, selecting 'Email & collaboration', clicking on 'Attack simulation training', and reviewing the specific report for the completed campaign.

Are the submitted passwords stored by Microsoft during the simulation?

No. Microsoft Defender is designed with privacy in mind. It does not store, log, or transmit the actual passwords submitted during these safe simulations; it simply registers the action to measure the user's risk level.

What happens to a user after they are marked as compromised?

Depending on your organization's policy settings, the Attack Simulation Training system will automatically assign the user targeted educational training modules to help them identify and avoid real phishing attempts in the future.

Microsoft Office Security Issues