> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Adaptive Security integration setup

> Connect Adaptive Security to the Living Security Platform to import phishing, smishing and vishing simulation outcomes plus security awareness training results for your workforce.

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

export const ConnectInPlatform = ({tile, children}) => <Step title="Enter the credentials in the Living Security Platform">
    <p>
      Completed by whoever holds Living Security access — the program owner, or the system
      admin if they've been invited (delegated setup).
    </p>
    <ol>
      <li>
        Go to <strong>Settings → Integrations → Catalog</strong>, find the{' '}
        <strong>{tile}</strong> tile, click <strong>Connect</strong>.
      </li>
      <li>
        Fill in the fields below, then click <strong>Connect</strong>.
      </li>
    </ol>
    {children}
  </Step>;

export const SystemAdminBanner = ({system, recommendDelegated}) => <Note>
    <p>
      <strong>This guide is for your {system} administrator.</strong> It covers creating API
      credentials inside {system}, which requires admin access to {system} — not to the
      Living Security Platform.
    </p>
    <p>
      If you're the Living Security <strong>program owner</strong> and don't administer {system},
      send this page to whoever does. They complete Part A and hand the credentials back to you
      (or enter them directly if you've invited them into the platform).
      {recommendDelegated && <>
          {' '}Because setup produces sensitive key material, we recommend the{' '}
          <strong>delegated setup</strong> path so the secret is never sent back to you.
        </>}
    </p>
  </Note>;

<SystemAdminBanner system="Adaptive Security" />

## What this integration contributes

Adaptive Security can contribute workforce, training, and multi-channel simulation
outcomes. Reviewed examples include:

* `phishing.simulation.clicked` — clicked a simulated email without reporting it
* `phishing.simulation.credential.submitted` — entered credentials on a simulated sign-in page
* `phishing.simulation.attachment.opened` — opened an attachment on a simulated email
* `phishing.simulation.reported` — reported a simulated email
* `smishing.simulation.replied` — replied to a simulated text message
* `vishing.simulation.succeeded` — complied with a simulated voice caller
* `training.assigned` — assigned security training
* `training.completed` — finished security training
* `training.past.due` — missed a training deadline

These examples show the types of normalized activity Living Security can use. See
[how integration data becomes signals](/signals/data-sources).

<Note>
  **Adaptive simulates over three channels, and Living Security scores each one separately.**
  Email outcomes score as phishing, text-message outcomes as smishing, and voice-call
  outcomes as vishing. A person who clicks a simulated email and one who replies to a
  simulated text are not measured as the same behaviour, because the judgement each one
  made is different.
</Note>

## What Living Security needs

| Credential    | Description                                                                                  |
| ------------- | -------------------------------------------------------------------------------------------- |
| **API token** | An Adaptive Security API token. Living Security sends it as a bearer token on every request. |

**Required role:** An administrator on your Adaptive Security account with access to
**Settings → API**. Adaptive governs API access with role-based permissions, so the
token must belong to a role that can read users, phishing and training.

**Access:** Read-only. Living Security only reads from Adaptive Security and never
creates, changes, or deletes anything in your account.

### What Living Security retrieves

| Data                  | Detail                                                                                                                                                                                |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **People**            | Your Adaptive user directory: name, email, department, job title, manager name and email, location, division, employment status and start date.                                       |
| **Email simulations** | Per person per simulation: when the message was delivered, opened, clicked, replied to, had its attachment opened, had its QR code scanned, had credentials entered, or was reported. |
| **Text simulations**  | Per person per simulation: delivered, opened, clicked, replied to, credentials entered, or reported.                                                                                  |
| **Voice simulations** | Per person per simulation: the lure delivered, the number called, whether the person complied with the caller, and whether they reported it.                                          |
| **Training**          | Per person per campaign: when they were enrolled, when it was due, when they started, when they completed it, and whether they acknowledged the campaign policy.                      |

<Note>
  **Phone numbers are not stored.** Adaptive returns office and mobile numbers on its user
  record. Living Security discards both before storing anything, because no Living Security
  feature uses them.
</Note>

<Note>
  **Adaptive's own risk score is recorded but never scored.** Adaptive computes a
  `current_risk_score` per person. Living Security keeps it so you can compare the two
  systems side by side, but the Human Risk Index is always calculated from observed
  behaviour using Living Security's own published model — never from another vendor's
  composite score.
</Note>

### Prerequisites

* An Adaptive Security account with the API enabled.
* Administrator access to [admin.adaptivesecurity.com](https://admin.adaptivesecurity.com).
* User email addresses in Adaptive that match the addresses your other connected systems
  use. Email is how Living Security matches an Adaptive user to a person.

***

## Part A — In Adaptive Security

*Your Adaptive Security administrator completes these steps.*

<Steps>
  <Step title="Open the API settings">
    1. Sign in to [admin.adaptivesecurity.com](https://admin.adaptivesecurity.com) as an administrator.
    2. Go to **Settings → API**.
  </Step>

  <Step title="Generate the API token">
    1. Generate a new API token.
    2. Give it a name you will recognise later — for example `Living Security`.
    3. Confirm the token's role can read users, phishing campaigns and training campaigns.
    4. Copy the token.

    <Warning>
      Copy the token before you leave the page. If your Adaptive account sets an expiry on the
      token, note the date — Living Security cannot retrieve data after it expires, and the
      connection has to be updated with a new token.
    </Warning>
  </Step>
</Steps>

***

## Part B — In the Living Security Platform

*The program owner completes this step, or the system admin if using delegated setup.*

<Steps>
  <ConnectInPlatform tile="Adaptive Security">
    | Field         | Value                             |
    | ------------- | --------------------------------- |
    | **API token** | The token you generated in Part A |
  </ConnectInPlatform>
</Steps>

You are now connected to Adaptive Security.

***

## How often data is retrieved

| Data                                     | Schedule      |
| ---------------------------------------- | ------------- |
| People                                   | Every 6 hours |
| Simulation outcomes (email, text, voice) | Every 6 hours |
| Training results                         | Every 6 hours |

Adaptive's reporting API does not offer a "what changed since" filter, so Living Security
reads each simulation and training campaign while it is still producing outcomes, and
stops reading it once it has been closed for two weeks. Late clicks and late reports are
therefore still captured, and finished campaigns are not re-read for ever.

<Note>
  A first connection on a large Adaptive account can take several scheduled runs to finish
  reading everything. Each run reads as much as it can and the next one continues from where
  it stopped, so counts climb over the first day or two rather than appearing all at once.
</Note>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="401 Unauthorized">
    The API token is wrong, expired, or was revoked. Adaptive returns an empty response body
    on this error, so there is no further detail to read. Generate a new token in
    **Settings → API** and reconnect with it. A partially-copied token produces the same
    error, and is the most common cause.
  </Accordion>

  <Accordion title="403 Forbidden">
    The token authenticated, but its role cannot read the data being requested. Re-pasting the
    same token will not help. In Adaptive, confirm the token's role has read access to users,
    phishing and training, or issue a token from a role that does.
  </Accordion>

  <Accordion title="429 Too Many Requests">
    Adaptive rate-limited the connection. Living Security stops that run and resumes from the
    same place on the next scheduled run, so no data is lost — counts simply take longer to
    climb. If this persists across days, contact Adaptive Security support to ask about the
    rate limit that applies to your account.
  </Accordion>

  <Accordion title="People appear, but no simulation outcomes">
    Check that the campaigns you expect have actually run. Adaptive reports enrollments only
    for simulations that have been sent, so a campaign still in **Draft** or **Scheduled**
    status contributes nothing until it goes out. Living Security deliberately does not read
    those, so that it spends its request budget on campaigns that have real outcomes.
  </Accordion>

  <Accordion title="Voice or text simulations are missing">
    Living Security decides the channel of each outcome from the scenario attached to it. If a
    scenario was deleted in Adaptive after its simulation ran, its outcomes are recorded
    against the email channel, because the channel can no longer be read. Keeping retired
    scenarios in Adaptive rather than deleting them avoids this.
  </Accordion>
</AccordionGroup>

<PublicIntegrationNextSteps />