Generating Simulated Spear Phishing Messages and Customized Cybersecurity Training Modules Using Machine Learning

A method, comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• sending, by the at least one processor and to a first enterprise user device, an initial simulated spear phishing electronic message;
• receiving, at the at least one processor and from the first enterprise user device, initial user interaction information indicating a manner in which a user of the first enterprise user device interacted with the initial simulated spear phishing electronic message;
• execute a machine learning model employing a series of branching message templates, wherein executing the machine learning model includes using, as inputs, the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message to output one or more first follow on simulated spear phishing electronic messages, wherein the one or more first follow on simulated spear phishing electronic messages are customized to target a weakness of a user based on the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message;
• sending, by the at least one processor and to the first enterprise user device, the one or more first follow on simulated spear phishing electronic messages;
• receiving, at the at least one processor and from the first enterprise user device, first additional user interaction information indicating a manner in which the user of the first enterprise user device interacted with the one or more first follow on simulated spear phishing electronic messages;
• computing, by the at least one processor, based on the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message, and the first additional user interaction information indicating the manner in which the user of the first enterprise user device interacted with the one or more first follow on simulated spear phishing electronic messages, one or more spear phishing scores corresponding to the user of the first enterprise user device, wherein computing the one or more spear phishing scores corresponding to the user of the first enterprise user device comprises:
• assigning a first value based on a type of response to the initial simulated spear phishing electronic message;
• assigning a second value based on a time difference between sending the initial simulated spear phishing electronic message and receiving the initial user interaction information;
• assigning a third value based on a type of response to the one or more first follow on simulated spear phishing electronic messages;
• assigning a fourth value based on a time difference between sending the one or more first follow on simulated spear phishing electronic messages and receiving the first additional user interaction information;
• and
• applying, using the first value, the second value, the third value, and the fourth value, a spear phishing scoring algorithm, wherein:
• the spear phishing scoring algorithm comprises:
• spear phishing score=α(first value+third value)+α(second value+third value), wherein:
• α is a first weight value, and
• β is a second weight value;
• comparing, by the at least one processor, the one or more spear phishing scores to one or more spear phishing thresholds;
• based on the comparison of the one or more spear phishing scores to the one or more spear phishing thresholds, generating, by the at least one processor, one or more customized spear phishing training modules for the user of the first enterprise user device;
• and
• sending, by the at least one processor and to the first enterprise user device, the one or more customized spear phishing training modules, wherein sending the one or more customized spear phishing training modules to the first enterprise user device causes the first enterprise user device to display the one or more customized spear phishing training modules.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• send, to a first enterprise user device, an initial simulated spear phishing electronic message;
• receive, from the first enterprise user device, initial user interaction information indicating a manner in which a user of the first enterprise user device interacted with the initial simulated spear phishing electronic message;
• execute a machine learning model employing a series of branching message templates, wherein executing the machine learning model includes using, as inputs, the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message to output one or more first follow on simulated spear phishing electronic messages, wherein the one or more first follow on simulated spear phishing electronic messages are customized to target a weakness of a user based on the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message;
• send, to the first enterprise user device, the one or more first follow on simulated spear phishing electronic messages;
• receive, from the first enterprise user device, first additional user interaction information indicating a manner in which the user of the first enterprise user device interacted with the one or more first follow on simulated spear phishing electronic messages;
• compute, based on the initial user interaction information indicating the manner in which the user of the first enterprise user device interacted with the initial simulated spear phishing electronic message and the first additional user interaction information indicating the manner in which the user of the first enterprise user device interacted with the one or more first follow on simulated spear phishing electronic messages, one or more spear phishing scores corresponding to the user of the first enterprise user device, wherein computing the one or more spear phishing scores corresponding to the user of the first enterprise user device comprises:
• assigning a first value based on a type of response to the initial simulated spear phishing electronic message;
• assigning a second value based on a time difference between sending the initial simulated spear phishing electronic message and receiving the initial user interaction information;
• assigning a third value based on a type of response to the one or more first follow on simulated spear phishing electronic messages;
• assigning a fourth value based on a time difference between sending the one or more first follow on simulated spear phishing electronic messages and receiving the first additional user interaction information;
• and
• applying, using the first value, the second value, the third value, and the fourth value, a spear phishing scoring algorithm, wherein:
• the spear phishing scoring algorithm comprises:
• spear phishing score=α(first value+third value)+β(second value+third value), wherein:
• α is a first weight value, and
• β is a second weight value;
• compare the one or more spear phishing scores to one or more spear phishing thresholds;
• based on the comparison of the one or more spear phishing scores to the one or more spear phishing thresholds, generate one or more customized spear phishing training modules for the user of the first enterprise user device;
• and
• send, to the first enterprise user device, the one or more customized spear phishing training modules, wherein sending the one or more customized spear phishing training modules to the first enterprise user device causes the first enterprise user device to display the one or more customized spear phishing training modules.