Method and apparatus for neutralizing real cyber threats to training materials

A method to support neutralizing real cyber threats to training materials, comprising:

• intercepting and detecting an active content in a payload of an email arriving at a recipient's email account within an entity or corporation;
• synchronously examining the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email;
• blocking the recipient from accessing the active content of the email if the active content is identified to be malicious to prevent the recipient from falling victim to the phishing attack;
• disassembling, isolating, and deactivating the malicious active content of the email once the active content of an email has been identified and blocked;
• replacing the malicious active content in the email with training data, wherein the training data is benign active content that is not harmful to the recipient even when he or she accesses the training data;
• reconstructing the payload of the email with the replaced benign training data and delivering the reconstructed payload of the email to the recipient in place of the original email for an anti-phishing training exercise.

A non-transitory storage medium having software instructions stored thereon that when executed cause a system to:

• intercept and detect an active content in a payload of an email arriving at a recipient's email account within an entity or corporation;
• synchronously examine the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email;
• block the recipient from accessing the active content of the email if the active content is identified to be malicious to prevent the recipient from falling victim to the phishing attack;
• disassemble, isolate, and deactivate the malicious active content of the email once the active content of an email has been identified and blocked;
• replace the malicious active content in the email with training data, wherein the training data is benign active content that is not harmful to the recipient even when he or she accesses the training data;
• reconstruct the payload of the email with the replaced benign training data and deliver the reconstructed payload of the email to the recipient in place of the original email for an anti-phishing training exercise.