<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-email-security-awareness
description: >-
  Implement email security awareness programs including phishing simulation
  campaigns, user training metrics, reporting mechanisms, gamification
  strategies, and continuous improvement based on behavioral analytics.
domain: cybersecurity
subdomain: email-security
tags:
  - security-awareness
  - phishing-simulation
  - training
  - metrics
  - gamification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566", "T1204"]
  tools: [gophish, king-phisher, m365-attack-simulator, python3]
---

# Implementing Email Security Awareness

## Overview

Email security awareness programs reduce the human attack surface through
phishing simulations, targeted training, and behavioral measurement. Effective
programs combine realistic simulations with immediate education, track metrics
over time, and adapt to emerging threat patterns.

## Prerequisites

- Tools: GoPhish, M365 Attack Simulator, King Phisher
- Organizational approval for phishing simulations
- Training content library and LMS integration

## Key Concepts

- **Phishing simulation**: Controlled fake phishing to test and train users
- **Click rate**: Percentage of users who click simulated phishing links
- **Report rate**: Percentage who report suspicious emails correctly
- **Phish-prone percentage**: Users who both click and submit credentials
- **Dwell time**: Time between receiving phish and reporting it

## Workflow

### Step 1: GoPhish Campaign Setup

```bash
# Install GoPhish
wget https://github.com/gophish/gophish/releases/latest/download/gophish-linux-64bit.zip
unzip gophish-linux-64bit.zip -d /opt/gophish/
chmod +x /opt/gophish/gophish

# Start GoPhish
cd /opt/gophish && ./gophish

# API: Create sending profile
curl -k -X POST https://localhost:3333/api/smtp/ \
  -H "Authorization: Bearer API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Phishing Test",
    "host": "smtp.example.com:587",
    "from_address": "it-support@example-corp.com",
    "username": "phish_user",
    "password": "phish_pass"
  }'
```

### Step 2: Campaign Templates and Landing Pages

```bash
# Create email template via API
curl -k -X POST https://localhost:3333/api/templates/ \
  -H "Authorization: Bearer API_KEY" \
  -d '{
    "name": "Password Reset",
    "subject": "Action Required: Password Expires Today",
    "html": "<html><body>Your password expires in 24 hours. <a href=\"{{.URL}}\">Reset now</a></body></html>",
    "text": "Your password expires. Visit {{.URL}} to reset."
  }'

# Create landing page (credential capture)
curl -k -X POST https://localhost:3333/api/pages/ \
  -H "Authorization: Bearer API_KEY" \
  -d '{
    "name": "Fake Login",
    "html": "<form method=POST><input name=username><input name=password type=password><button>Login</button></form>",
    "capture_credentials": true,
    "redirect_url": "https://training.example.com/you-were-phished"
  }'
```

### Step 3: M365 Attack Simulator

```powershell
# Create simulation (M365 Security portal)
# Security > Attack simulation training > Simulations > Create

# Available techniques:
# - Credential harvest
# - Malware attachment
# - Link in attachment
# - Link to malware
# - Drive-by URL

# Configure payload and target groups via portal
# Set training assignment for users who fail
```

### Step 4: Metrics Collection and Analysis

```python
import json
from datetime import datetime

def analyze_campaign(results: list[dict]) -> dict:
    total = len(results)
    opened = sum(1 for r in results if r.get("opened"))
    clicked = sum(1 for r in results if r.get("clicked"))
    submitted = sum(1 for r in results if r.get("submitted_data"))
    reported = sum(1 for r in results if r.get("reported"))

    return {
        "total_targets": total,
        "email_open_rate": f"{opened/total*100:.1f}%",
        "click_rate": f"{clicked/total*100:.1f}%",
        "credential_submit_rate": f"{submitted/total*100:.1f}%",
        "report_rate": f"{reported/total*100:.1f}%",
        "phish_prone_pct": f"{submitted/total*100:.1f}%",
        "resilience_ratio": f"{reported/max(clicked,1):.2f}",
    }
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Low report rate | Campaign metrics | Users not reporting suspicious email |
| High click rate | Campaign metrics | Department with elevated phish susceptibility |
| Repeat clickers | Historical data | Users failing multiple simulations |

```yaml
title: Phishing Simulation Click Tracked
id: f2a3b4c5-d6e7-8901-f012-234567890abc
status: experimental
description: Tracks user interaction with phishing simulation for awareness metrics
logsource:
  category: application
  product: gophish
detection:
  selection:
    event_type: "clicked_link"
  condition: selection
falsepositives:
  - Security team testing simulation infrastructure
level: informational
tags:
  - attack.t1204
  - attack.execution
```

## Verification

- [ ] Phishing simulation platform deployed and tested
- [ ] Campaign templates created for multiple scenarios
- [ ] Target groups defined by department and risk level
- [ ] Training content assigned for simulation failures
- [ ] Metrics dashboard tracking click and report rates over time

## References

- [GoPhish Documentation](https://docs.getgophish.com/)
- [NIST SP 800-50 — Security Awareness](https://csrc.nist.gov/publications/detail/sp/800-50/final)
- [M365 Attack Simulation](https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started)
