Dynamically injecting security awareness training prompts into enterprise user flows

A method, comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• monitoring a plurality of user devices associated with an enterprise organization, monitoring the plurality of user devices associated with the enterprise organization including monitoring actions requested by a user and executed by a respective user device of the plurality of user devices in performing various job functions of the user associated with the user device;
• detecting, in real-time, a first cybersecurity training triggering event at a first user device of the plurality of user devices of the enterprise organization, the first cybersecurity training triggering event including a plurality of event details and being detected in performance of the job functions of a first user;
• detecting, in real-time, a second cybersecurity training triggering event at a second user device of the plurality of user devices of the enterprise organization, the second cybersecurity training triggering event including a plurality of event details and being detected in performance of the job functions of a second user;
• processing, in parallel, the detected first cybersecurity training triggering event and the detected second cybersecurity training triggering event, wherein processing the detected first cybersecurity training triggering event and the detected second cybersecurity training triggering event includes, for each detected cybersecurity training triggering event:
• receiving event details of a respective cybersecurity training triggering event;
• retrieving user profile data, the user profile data for a respective user associated with the respective cybersecurity training triggering event and including an overall cybersecurity score of the respective user and one or more user characteristics;
• analyzing the respective cybersecurity training triggering event and event details to identify a type of cybersecurity training triggering event;
• generating, based on the identified type of cybersecurity training triggering event and the user profile, a cybersecurity training session prompt and expected response data, wherein the cybersecurity training session prompt includes one or more user interfaces including identification of the cybersecurity training triggering event detected in performance of the job functions of a respective user and one or more questions generated based on the cybersecurity triggering event and specific to the cybersecurity triggering event, and one or more user characteristics from the user profile;
• transmitting, via the communication interface, the generated cybersecurity training session prompt to the respective user device associated with the respective user, wherein transmitting the generated cybersecurity training session prompt to the respective user device causes the respective user device to execute the generated cybersecurity training session prompt and wherein executing the cybersecurity training session prompt causes display of one or more user interfaces associated with the cybersecurity training session prompt by a display of the respective user device;
• receiving, from the respective user device via the one or more user interfaces associated with the cybersecurity training session prompt and in response to execution of the cybersecurity training session prompt, user response data received via the generated cybersecurity training session prompt;
• comparing the received user response data to the expected response data to determine whether the received user response data matches the expected response data;
• computing, based on the comparing, a cybersecurity training session score associated with an outcome of the comparison, wherein computing the cybersecurity training session score includes applying a weight value to a baseline value associated with the comparison, and wherein the weight value is selected based on a role of the respective user within the enterprise organization;
• updating, based on the cybersecurity training session score of the outcome of the comparison, the overall cybersecurity score of the respective user associated with the respective user device;
• in response to computing the cybersecurity training session score, identifying, based on the computed cybersecurity training session score, a plurality of modifications to access permissions, wherein the plurality of modifications to access permissions includes at least one modification related to the detected respective cybersecurity training triggering event and at least one modification not related to the detected respective cybersecurity training triggering event;
• and
• transmitting the modification to the access permissions to the respective user device, wherein transmitting the modification to the access permissions to the respective user device causes the respective user device to execute the modifications and modify the access permissions.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• monitor a plurality of user devices associated with an enterprise organization, monitoring the plurality of user devices associated with the enterprise organization including monitoring actions requested by a user and executed by a respective user device of the plurality of user devices in performing various job functions of the user associated with the user device;
• detect, in real-time, a first cybersecurity training triggering event at a first user device of the plurality of user devices of the enterprise organization, the first cybersecurity training triggering event including a plurality of event details and being detected in performance of the job functions of a first user;
• detect, in real-time, a second cybersecurity training triggering event at a second user device of the plurality of user devices of the enterprise organization, the second cybersecurity training triggering event including a plurality of event details and being detected in performance of the job functions of a second user;
• process, in parallel, the detected first cybersecurity training triggering event and the detected second cybersecurity training triggering event, wherein processing the detected first cybersecurity training triggering event and the detected second cybersecurity training triggering event includes, for each detected cybersecurity training triggering event:
• receive event details of a respective cybersecurity training triggering event;
• retrieve user profile data, the user profile data for a respective user associated with the respective cybersecurity training triggering event and including an overall cybersecurity score of the respective user and one or more user characteristics;
• analyze the respective cybersecurity training triggering event and event details to identify a type of cybersecurity training triggering event;
• generate, based on the identified type of cybersecurity training triggering event and the user profile, a cybersecurity training session prompt and expected response data, wherein the cybersecurity training session prompt includes one or more user interfaces including identification of the cybersecurity training triggering event detected in performance of the job functions of a respective user, and one or more questions generated based on the cybersecurity triggering event and specific to the cybersecurity triggering event and one or more user characteristics from the user profile;
• transmit, via the communication interface, the generated cybersecurity training session prompt to the respective user device associated with the respective user, wherein transmitting the generated cybersecurity training session prompt to the respective user device causes the respective user device to execute the generated cybersecurity training session prompt and wherein executing the cybersecurity training session prompt causes display of one or more user interfaces associated with the cybersecurity training session prompt by a display of the respective user device;
• receive, from the respective user device via the one or more user interfaces associated with the cybersecurity training session prompt and in response to execution of the cybersecurity training session prompt, user response data received via the generated cybersecurity training session prompt;
• compare the received user response data to the expected response data to determine whether the received user response data matches the expected response data;
• compute, based on the comparing, a cybersecurity training session score associated with an outcome of the comparison, wherein computing the cybersecurity training session score includes applying a weight value to a baseline value associated with the comparison, and wherein the weight value is selected based on a role of the respective user within the enterprise organization;
• update, based on the cybersecurity training session score of the outcome of the comparison, the overall cybersecurity score of the respective user associated with the respective user device;
• in response to computing the cybersecurity training session score, identify, based on the computed cybersecurity training session score, a plurality of modifications to access permissions, wherein the plurality of modifications to access permissions includes at least one modification related to the detected respective cybersecurity training triggering event and at least one modification not related to the detected cybersecurity training triggering event;
• and
• transmit the modification to the access permissions to the respective user device, wherein transmitting the modification to the access permissions to the respective user device causes the respective user device to execute the modifications and modify the access permissions.