Generating and deploying phishing templates

A method, comprising:

• receiving a set of email messages that are associated with a set of users and that are associated with an indication of legitimacy;
• performing clustering on the set of email messages to identify a subset of similar email messages from the set of email messages and a subset of users from the set of users that are associated with the subset of similar email messages;
• generating, for the subset of users, an email template based on the subset of similar email messages;
• incorporating, into the email template, at least one indicator of phishing;
• generating, from the email template, a test email message addressed to at least one user in the subset of users and based on at least one email message in the subset of similar email messages;
• transmitting the test email message to the at least one user;
• receiving an indication of one or more interactions with the test email message;
• determining, based on the indication, a category for the one or more interactions, wherein the category is associated with a positive or negative interaction with the test email message;
• and
• transmitting a report based on the category.

A non-transitory computer-readable medium storing a set of instructions for generating and deploying phishing templates, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• receive a set of email messages that are associated with a set of users and that are associated with an indication of legitimacy;
• perform clustering on the set of email messages to identify a subset of similar email messages from the set of email messages and a subset of users from the set of users that are associated with the subset of similar email messages;
• generate, for the subset of users, an email template based on the subset of similar email messages;
• incorporate, into the email template, at least one indicator of phishing;
• generate, from the email template, a test email message addressed to at least one user in the subset of users and based on at least one email message in the subset of similar email messages;
• transmit the test email message to the at least one user;
• receive an indication of one or more interactions with the test email message;
• determine, based on the indication, a category for the one or more interactions, wherein the category is associated with a positive or negative interaction with the test email message;
• and
• transmit a report based on the category.