Determining authenticity of reported user action in cybersecurity risk assessment

A method of authenticating a user-reported action in a cybersecurity risk assessment campaign, the method comprising:

• by an electronic device that includes a messaging client that is associated with a first recipient and that is configured to receive electronic messages, executing programming instructions that cause the electronic device to:
• identify an electronic message that is directed to the first recipient and received by the messaging client;
• receive a command for the messaging client to forward the electronic message from the first recipient to a second recipient;
• analyze the electronic message to determine whether the electronic message is a simulated malicious message;
• upon determining that electronic message is a simulated malicious message:
• identify an actuatable element in the electronic message, wherein the electronic message also comprises content other than the actuatable element, and
• modify the electronic message by appending a user identifier to the actuatable element, which results in a modified message with a modified actuatable element;
• and
• cause the messaging client to forward the modified message with the modified actuatable element to the second recipient.