Systems and methods for reporting based simulated phishing campaign
AssigneeKnowBe4, Inc.
InventorsGreg Kras, Alin Irimie
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for leveraging the knowledge and security awareness of well-informed users in an organization to protect other users and train them to identify new phishing attacks. Initially, a report of a message being suspicious may be identified and it may be determined whether message is a malicious phishing message. In an example, a well-informed user of an organization may report the message as suspicious. Further, on determining the message to be a malicious phishing message, a simulated phishing message or a template may be created. The simulated phishing message may then be communicated to one or more devices of one or more users.
Claims14
A method for creating a simulated phishing message based on a phishing attack, the method comprising:
- (a) identifying, by one or more processors, a report of a message, the message received by a user and reported as being suspicious during the phishing attack;
- (b) determining, by the one or more processors, that the message is a malicious phishing message instead of a simulated phishing message communicated by the one or more processors;
- (c) creating, by the one or more processors responsive to the determination that the message is a malicious phishing message and using the content of the malicious phishing message, a simulated phishing message or a template for the simulated phishing message by one of removing or modifying one or more malicious elements from the content of the malicious phishing message wherein the malicious elements in links of the message to include one or more links to training content when interacted with by a user;
- (d) causing, by the one or more processors, the message in a messaging application of a user to be replaced with the simulated phishing message.
A system for creating a simulated phishing message based on a phishing attack, the system comprising:
- one or more processors, coupled to memory, and configured to:
- identify a report of a message, the message received by a user and reported as being suspicious s during the phishing attack;
- determine that the message is a malicious phishing message instead of a simulated phishing message communicated by the one or more processors
- create, responsive to the determination that the message is a malicious phishing message and using the content of the malicious phishing message, a simulated phishing message or a template for the simulated phishing message by one of removing or modifying one or more malicious elements from the content of the malicious phishing message and modifying one or more links of the message to include one or more links to training content when interacted with by a user;
- and
- cause, by the one or more processors, the message in a messaging application of a user to be replaced with the simulated phishing message.
Dependencies are inferred from the claim text.