Platform
Integrations

Integrations that fit the tools you already run.

Cyberfrog reads your directory, delivers through your mail system, sits in your employees’ inbox and streams every event to your SOC. Set up in minutes, without changing how your team works.

Book a demo See all 38 integrations

Entra ID, Google, Okta, LDAP, SCIM
SAML and OIDC
Sentinel, Splunk, syslog, webhooks
Outlook, Gmail, Defender

01Identity and directory

People in sync, without a spreadsheet.

Connect Microsoft Entra ID, Google Workspace, Okta or your Active Directory once. New colleagues get their onboarding training, movers change track, leavers drop out of campaigns, and their history stays for your reports.

Pull: Every hour, read-only, from Entra ID, Google Workspace, Okta and LDAP.
Push: SCIM 2.0 from Entra ID and Okta, the moment something changes.
On-premises AD: A small local connector that only talks out over HTTPS. Your bind password stays inside your network.
Rules: Choose which groups sync, and what happens to joiners, movers and leavers. A dry run shows the effect first.
Sign-in: SAML 2.0 or OpenID Connect single sign-on for admins, and authenticator-app MFA.

02Email delivery

Simulations that land in the inbox.

A simulation caught by the spam filter teaches nothing. Cyberfrog delivers through Microsoft 365 or Gmail directly, or through its own mail servers, and sets up the DNS records for every sending domain.

Microsoft 365 Graph
Gmail API
Cyberfrog mail servers
SendGrid
Postmark
Custom SMTP

Domains: Buy a simulation domain in the admin or bring your own. SPF, DKIM, DMARC and MX are created and checked.
Allowlisting: Step-by-step setup for Microsoft 365 Advanced Delivery and Google Workspace, with the exact domains and IPs for your account.
Timing: Each person’s local time, quiet hours, no weekends, or spread over several business days.

03Phishing reporting, SOC and SIEM

Every event, in your SOC.

Employees report suspicious email with one click in Outlook or Gmail. Cyberfrog recognises its own simulations, rewards the reporter and sends real threats on to Microsoft Defender or your SOC mailbox, while every click, report and completion streams into your SIEM.

Report button: Outlook on desktop, web, Mac and mobile, and Gmail on web, Android and iOS.
Hand-off: Microsoft Defender user-reported messages, one or more SOC mailboxes, or a signed webhook.
Event stream: Microsoft Sentinel, Splunk, syslog with CEF, and HMAC-signed webhooks for XSOAR, Tines or ServiceNow.

Simulation delivered
Signed header, logged per person.
Reported or clicked
Both become events in seconds.
Training assigned
The right lesson for the people who need it.
Risk updated
Scores and dashboards in Cyberfrog and your SIEM.

04Developer API

Everything in the admin, also over the API.

A versioned REST API with OpenAPI documentation: manage templates, rules, sender profiles and domains, read statistics and pull exports. Keys are created and revoked in the admin.

/v1/training-templates
/v1/email-templates
/v1/training-rules
/v1/sender-profiles
/v1/tenant-domains
/v1/stats

# Phishing results by department, last 90 days
curl https://dashboard.cyberfrogsecurity.com/api/v1/stats/by-department \
  -H "Authorization: Bearer cfk_live_..."

# Response
[
  { "department": "Finance",     "delivered": 42, "clicked": 3, "reported": 29 },
  { "department": "Sales",       "delivered": 96, "clicked": 9, "reported": 51 },
  { "department": "Engineering", "delivered": 61, "clicked": 1, "reported": 47 }
]

05All integrations

38 integrations, one admin.

Each one is switched on in the admin, per customer. Filter by what you want to connect.

Missing an integration? Tell us.

We build integrations with our customers. Name the tool and we will tell you what is possible.