Method and apparatus for training email recipients against phishing attacks using real threats in realtime

A method to support anti-phishing training using real attacks in real time, comprising:

• intercepting and detecting an active content of an email arriving at a recipient's email account within an entity or corporation;
• synchronously examining the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email;
• delivering the active content of the email to the recipient if the active content is determined to be safe for access by the recipient;
• blocking the recipient from accessing the active content of the email if the active content is determined to be malicious to prevent the recipient from falling victim to the phishing attack;
• re-directing the recipient to a safe blocking mechanism designed to alert the recipient of the phishing attack once the phishing attack is blocked;
• customizing and providing an anti-phishing training exercise to the recipient, wherein content of the anti-phishing training exercise is specifically customized for the recipient based on the blocked phishing attack the recipient received in the email and/or the recipient's security posture and awareness.

A non-transitory storage medium having software instructions stored thereon that when executed cause a system to:

• intercept and detect an active content of an email arriving at a recipient's email account within an entity or corporation;
• synchronously examine the active content of the email in real time for potential malicious intent of a phishing attack when the recipient attempts to access the active content of the email;
• deliver the active content of the email to the recipient if the active content is determined to be safe for access by the recipient;
• block the recipient from accessing the active content of the email if the active content is determined to be malicious to prevent the recipient from falling victim to the phishing attack;
• re-direct the recipient to a safe blocking mechanism designed to alert the recipient of the phishing attack once the phishing attack is blocked;
• customize and provide an anti-phishing training exercise to the recipient, wherein content of the anti-phishing training exercise is specifically customized for the recipient based on the blocked phishing attack the recipient received in the email and/or the recipient's security posture and awareness.