Phishing event detection

An apparatus for phishing event detection, comprising:

• one or more memories storing processor-executable code;
• and
• one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:
• receive, at a security system, a request to access a resource of a uniform resource locator (URL) using a credential of a user of an organization;
• categorize the request to access the resource of the URL as a phishing event;
• extract one or more attributes from the phishing event based at least in part on categorizing the request as the phishing event;
• perform, in real-time, at least one first phishing protection operation that is in accordance with the extracted one or more attributes;
• and
• perform at least one second phishing protection operation that is in accordance with an output of a model of the security system that is trained using the one or more attributes.

A non-transitory computer-readable medium storing code for phishing event detection, the code comprising instructions executable by one or more processors to:

• receive, at a security system, a request to access a resource of a uniform resource locator (URL) using a credential of a user of an organization;
• categorize the request to access the resource of the URL as a phishing event;
• extract one or more attributes from the phishing event based at least in part on categorizing the request as the phishing event;
• perform, in real-time, at least one first phishing protection operation that is in accordance with the extracted one or more attributes;
• and
• perform at least one second phishing protection operation that is in accordance with an output of a model of the security system that is trained using the one or more attributes.