A phishing simulation report is only as good as what happens next. Someone clicks the lure, the MSP sees it in Cyber Aware, and then - if the PSA doesn't know - the same person keeps clicking until a real attack lands. Connecting Cyber Aware to Freshservice closes that loop: every phishing report or high-risk event can become a ticket the service desk actually owns.
TL;DR
- Freshservice's Zapier app fires instant triggers for New Ticket and New Agent, and actions include Create Ticket and Update Ticket.
- Freshservice's API uses API-key authentication with the key as the username and X as the password, and responds 401/403 for bad or missing credentials.
- Cyber Aware connects via Zapier webhooks or a direct API; its published integration list is Google Workspace, Microsoft 365, Zapier and API.
- The practical route: Cyber Aware phishing events to Zapier to Freshservice tickets, so the service desk chases every click.
- Freshservice will reject a ticket if required fields - subject, description, requester - are missing, and the department field must be numeric when mapped.
- Test with one synthetic phishing report before pointing anything at live events.
Why this matters
A click that never becomes a ticket never gets a conversation. The human-risk data says the person is a repeat clicker; the service desk has no record, so no one follows up, no refresher is assigned and the same mailbox gets phished again in three weeks. Closing the loop means every simulated click carries a follow-up action in the system where follow-ups actually live.
Freshservice's developer documentation covers the authentication and error conventions this guide relies on: API requests use basic auth with the API key as the username and X as the password, and the API responds 401 for missing or invalid credentials and 403 for insufficient privileges. Their own integration guide to linking apps with Zapier describes the same two-direction pattern as every PSA sync: an event in one system triggers an action in the other, with a test step between every stage. On Zapier, Freshservice's New Ticket trigger is instant - a webhook rather than polling.
Who this is for
MSPs and internal IT teams running Freshservice who deliver phishing simulations and awareness training through Cyber Aware - especially service desks that already triage security alerts as tickets and want phishing reports to join the same queue.
Before you start
- A Freshservice account with API access. Admins generate the API key under Profile Settings. Treat it like a password - it authenticates every read and write the integration makes.
- A Zapier account on a plan that supports multi-step Zaps.
- A Cyber Aware partner account with API or Zapier webhook access.
- The gotcha: Freshservice validates ticket fields on create - a missing subject, description or requester id fails the step. Map every required field before the first live test, and note that department accepts a numeric id, not a name.
Step 1 - Connect Cyber Aware events to Zapier
- In Cyber Aware, point the phishing-event webhook at Zapier's webhook trigger, or use Cyber Aware's API to poll simulation events.
- Choose what should flow: a phishing simulation click, a repeat-clicker flag, or a monthly report-ready event. Start narrow - clicks from repeat clickers only - so the queue stays meaningful.
- Send one test payload and confirm the Zap sees the sample data: user, simulation name, click timestamp.
Expected result: the test step returns a sample Cyber Aware event with the learner's email populated. If fields are empty, check the webhook payload configuration in Cyber Aware before mapping.
Step 2 - Create the ticket in Freshservice
- Add an action step: Freshservice, Create Ticket.
- Map the learner's email to requester, the simulation name and click time into subject and description, and set priority and type to match the service desk's security queue.
- Save and test with the sample payload.
Expected result: a test ticket appears in Freshservice assigned to the right group. From here the service desk does what it already does - follow up, assign a refresher course, note the response - and the trail lives in the PSA, not in someone's inbox.
Step 3 - Map fields that commonly break
- Requester: must resolve to a Freshservice requester; a learner who has never contacted the service desk may not exist yet. Use Find User first, then create.
- Department: numeric id only. Look the id up once in Freshservice and hardcode or map it.
- Priority/type: map to the desk's existing security values so triage doesn't reclassify every ticket by hand.
Step 4 - Use the reverse direction for enrolment
Freshservice's Zapier actions also include Update Ticket and user-facing triggers like New Agent, and Freshservice's API can read and create requester records directly - useful when a new client's staff need Cyber Aware accounts and the service desk is the system that knows them. The same pattern as this guide with the arrow pointing the other way.
Verification and a clean rollout
- Send one synthetic phishing event from a test learner.
- Confirm the ticket appears in Freshservice with requester, subject and priority correct.
- Confirm the reverse flow - if used - creates the learner in Cyber Aware.
- Switch live events on one client at a time, starting with repeat clickers.
Troubleshooting
- 401 on a Freshservice step. The API key is missing or wrong - regenerate under Profile Settings and reconnect. Freshservice's API returns 401 for bad credentials and 403 for insufficient privileges.
- Ticket creation fails. A required field is empty - subject, description or requester. Map all three before testing again.
- Department rejected. The field wants a numeric id, not a name.
- Duplicate tickets. The Zap fires on both the click and the simulation-close event. Keep one trigger per Zap or add a filter step.
- Ticket spam from one learner. Throttle at the Zap level - one ticket per learner per simulation, not per click.
What to do next
The ticket trail is the back half of the loop; the front half is phishing simulations - realistic lures, tracked clicks and instant micro-training. The numbers behind the tickets come from Human Risk Reporting, which turns simulation and training data into a per-client score the service desk and the client both read from.
FAQ
Can Cyber Aware connect to Freshservice directly?
No native Freshservice connector appears in Cyber Aware's published integration list - Google Workspace, Microsoft 365, Zapier and a direct API. Freshservice's Zapier app plus Cyber Aware's API or webhooks is the supported route.
What triggers does Freshservice have on Zapier?
New Ticket and New Agent as instant triggers, with Create Ticket, Update Ticket and Find-style actions available.
How does Freshservice's API authenticate?
Basic auth with the API key as the username and X as the password - the key is generated under Profile Settings by an admin.
Which field breaks most often?
Department - it needs the numeric id, not the display name. Requester is the second: the learner must exist as a Freshservice requester before a ticket can be filed against them.
Is the phishing data branded?
Yes - Cyber Aware's portals, notification emails, reports and certificates carry your MSP brand, and the ticket text you map can too.
Can this sync training completions as well as clicks?
Yes - the same webhook pattern can file a ticket when a monthly report is ready or when a learner goes overdue, so the service desk sees the whole programme, not just the failures.
One last thing
A phishing ticket that just says "user clicked" teaches nobody anything. Map the lure type and the micro-training link into the ticket description so the service desk's follow-up is a 30-second conversation that ends in a completed lesson - the gap assessment toolkit covers the follow-up controls worth pairing with it.