Dynamically Providing Cybersecurity Training Based on User-Specific Threat Information

A method comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• receiving, via the communication interface, user-specific threat information for a plurality of users indicating at least one threat that has been encountered by the plurality of users;
• identifying a first set of users of the plurality of users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information, based on monitoring a number of interactions each user of the first set of users has with network links in a plurality of email messages and determining whether the number of interactions of each user of the first set of users exceeds a threshold number of interactions;
• for each of the identified first set of users:
• selecting one or more pre-generated computer-executable cybersecurity training modules corresponding to the cybersecurity training in the first cybersecurity training topic;
• dynamically adapting, based on the user-specific threat information corresponding to the user, the one or more cybersecurity training modules to generate one or more dynamically adapted user-specific cybersecurity training modules;
• and
• providing the one or more dynamically adapted user-specific cybersecurity training modules to a computing device of the user.

​ The method of claim 12, further comprising:

• identifying a second set of users of the plurality of users that do not require cybersecurity training by, for each of the second set of users:
• comparing, based on monitoring interactions of the user with network links embedded in a plurality of email messages, a number of times the user interacts with the network links in the plurality of email messages with the threshold number of interactions;
• and
• determining that the number of times the user interacts with the network links embedded in the plurality of email messages is lower than the threshold number of interactions.

​ A non-transitory computer-readable medium storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• receive, via the communication interface, user-specific threat information for a plurality of users indicating at least one threat that has been encountered by the plurality of users;
• identify a first set of users of the plurality of users to receive cybersecurity training in a first cybersecurity training topic based on the user-specific threat information, based on monitoring a number of interactions each user of the first set of users has with network links in a plurality of email messages and determining whether the number of interactions of each user of the first set of users exceeds a threshold number of interactions;
• for each of the identified first set of users:
• select one or more pre-generated computer-executable cybersecurity training modules corresponding to the cybersecurity training in the first cybersecurity training topic;
• dynamically adapt, based on the user-specific threat information corresponding to the user, the one or more cybersecurity training modules to generate one or more dynamically adapted user-specific cybersecurity training modules;
• and
• provide the one or more dynamically adapted user-specific cybersecurity training modules to a computing device of the user.

​The non-transitory computer-readable medium of claim 19, wherein the instructions, when executed, further cause the computing platform to:

• identify a second set of users of the plurality of users that do not require cybersecurity training by, for each of the second set of users:
• comparing, based on monitoring interactions of the user with network links embedded in a plurality of email messages, a number of times the user interacts with the network links in the plurality of email messages with the threshold number of interactions;
• and
• determining that the number of times the user interacts with the network links embedded in the plurality of email messages is lower than the threshold number of interactions.