<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-anti-phishing-training-programs
description: >-
  Design, deploy, and measure anti-phishing security awareness training
  programs including simulated phishing campaigns, click-rate tracking,
  repeat-offender workflows, and compliance-driven training schedules.
domain: cybersecurity
subdomain: phishing-defense
tags:
  - security-awareness
  - phishing-simulation
  - training-metrics
  - click-rate
  - human-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Implementing Anti-Phishing Training Programs

## Overview

Human error remains the primary vector for successful phishing attacks. This
skill covers designing phishing simulation campaigns, deploying security
awareness training, measuring effectiveness through click rates and report
rates, managing repeat offenders, and building a continuous improvement cycle
that measurably reduces organizational phishing risk.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling runtime |
| GoPhish | `go install github.com/gophish/gophish@latest` |
| `jq` | JSON processing for API responses |
| SMTP relay access | For simulation email delivery |
| curl | API interaction with training platforms |

## Key Concepts

### Phishing Simulation Maturity Model

```
Level 1 — Ad-hoc      : Occasional test emails, no tracking
Level 2 — Managed     : Quarterly campaigns, click-rate tracking
Level 3 — Measured    : Segmented campaigns, report-rate KPIs, repeat-offender flow
Level 4 — Optimized   : Adaptive difficulty, department risk scoring, gamification
Level 5 — Predictive  : ML-driven targeting, behavioral baselines, risk forecasting
```

### Core Metrics

| Metric | Target | Calculation |
|---|---|---|
| Click Rate | < 5% | Clicks / Emails Delivered |
| Report Rate | > 60% | Reports / Emails Delivered |
| Time-to-Report | < 5 min | Median time from delivery to report |
| Repeat Offender Rate | < 2% | Users clicking 2+ campaigns |
| Training Completion | > 95% | Completed / Assigned |

### Campaign Difficulty Tiers

```
Tier 1 — Obvious      : External sender, typos, urgent language, suspicious URL
Tier 2 — Moderate     : Branded template, plausible pretext, hidden URL
Tier 3 — Targeted     : Internal sender spoofed, context-aware, clean domain
Tier 4 — Spear        : Personalized content, compromised thread, look-alike domain
```

## Workflow

### 1. Configure GoPhish Campaign

```bash
# Start GoPhish server
./gophish &

# Create sending profile via API
curl -s -k -X POST https://localhost:3333/api/smtp/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Simulation SMTP",
    "host": "smtp.internal.com:587",
    "from_address": "it-support@company-notifications.com",
    "username": "simuser",
    "password": "simpass",
    "ignore_cert_errors": false
  }'

# Create target group
curl -s -k -X POST https://localhost:3333/api/groups/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Q1-2026 Engineering",
    "targets": [
      {"first_name": "Test", "last_name": "User", "email": "test@company.com"}
    ]
  }'
```

### 2. Design Simulation Templates

```bash
# List existing templates
curl -s -k https://localhost:3333/api/templates/ \
  -H "Authorization: Bearer ${GOPHISH_API_KEY}" | jq '.[].name'

# Use agent to generate campaign configuration
node agent.js design-campaign --tier 2 --department engineering --size 50
```

### 3. Launch and Monitor Campaign

```bash
# Launch campaign
node agent.js launch-campaign --name "Q1-2026-Eng" --template-id 1 \
  --group-id 1 --send-by-date "2026-03-20T17:00:00Z"

# Monitor real-time results
node agent.js campaign-status --campaign-id 1

# Export results for reporting
node agent.js export-metrics --campaign-id 1 --format json
```

### 4. Repeat Offender Workflow

```bash
# Identify repeat offenders across campaigns
node agent.js repeat-offenders --threshold 2 --window 90d

# Generate targeted training assignments
node agent.js assign-training --user-list /tmp/repeat_offenders.json \
  --module "advanced-phishing-awareness"
```

## Detection

```yaml
title: Anti Phishing Training Programs Detection
id: 08c6aff6-9e63-4ef3-8ac5-32b97884221a
status: experimental
description: Detects suspicious activity related to implementing anti phishing training programs techniques in phishing defense context
logsource:
  category: email
  service: o365
detection:
  selection:
    Subject: "*urgent*"
  condition: selection
level: high
tags:
  - attack.t1566
  - attack.initial_access
falsepositives:
  - Security awareness training platform sending simulated phishing emails
```

## Verification

| Check | Method |
|---|---|
| Campaign delivered | GoPhish dashboard shows emails sent |
| Click tracking functional | Test click registers in results |
| Report button configured | Phish alert button submits to tracking |
| Metrics calculated | Export shows click rate and report rate |
| Repeat offenders identified | Query returns users with multiple clicks |
| Training assigned | LMS shows pending assignments for flagged users |

## References

- [GoPhish Documentation](https://docs.getgophish.com/)
- [NIST SP 800-50 — Security Awareness Training](https://csrc.nist.gov/publications/detail/sp/800-50/final)
- [SANS Security Awareness Maturity Model](https://www.sans.org/security-awareness-training/resources/maturity-model/)
- [KnowBe4 Benchmarking Report](https://www.knowbe4.com/phishing-benchmarking-report)
- [Cofense Phishing Intelligence](https://cofense.com/knowledge-center/)
