Methods and systems for implementing a phishing assessment

A system that implements a phishing campaign that tests for computer security vulnerabilities in a target computer network, the system includes:

• a phishing assessment computer that automatically configures and/or generates one or more test parameters of the phishing campaign including:
• automatically generating a pseudo domain name and a pseudo web page using target entity data, wherein the target entity data includes one or more of a name of a target entity and a legitimate web page associated with the target entity;
• automatically selecting a plurality of target users of the target computer network as targets of the phishing campaign;
• using one or more of the pseudo domain name and the pseudo web page to generate one or more phishing attack communications;
• configuring one or more phishing communication vectors for the phishing campaign to transmit the one or more phishing attack communications;
• setting a predetermined drip schedule that implements the phishing campaign over a predetermined period and that transmits the one or more phishing attack communications to different subsets of the plurality of target users during different times during the predetermined period:
• transmitting the one or more phishing attack communications, via the one or more phishing communication vectors, to the different subsets of the plurality of target users according to the predetermined drip schedule;
• collecting target user activity data, wherein the target user activity data includes data describing interactions of the one or more target users with the one or more phishing attack communications;
• identifying at-risk target users based on the collected target user activity data, wherein the at-risk target users include a set of the plurality of target users that succumbed to the one or more phishing attack communications;
• generating a phishing risk analysis of the target computer network based on the collected target user activity data;
• and wherein the configuring and/or generating the one or more test parameters of the phishing campaign includes:
• configuring at least two of the one or more phishing communication vectors to work in concert, wherein a first of the at least two phishing communication vectors includes a message that directs a target user to interact with a phishing attack communication message of a second of the at least two phishing communication vectors.

A non-transitory computer program product comprising computer-executable instructions that, when executed by one or more computer processors, performs:

• automatically generating a pseudo domain name and a pseudo web page using target entity data, wherein the target entity data includes one or more of a name of a target entity and a legitimate web page associated with the target entity;
• automatically selecting a plurality of target users of the target computer network as targets of the phishing campaign;
• using one or more of the pseudo domain name and the pseudo web page to generate one or more phishing attack communications;
• configuring one or more phishing communication vectors for the phishing campaign to transmit the one or more phishing attack communications;
• setting a predetermined drip schedule that implements the phishing campaign over a predetermined period and that transmits the one or more phishing attack communications to different subsets of the plurality of target users during different times during the predetermined period;
• transmitting the one or more phishing attack communications, via the one or more phishing communication vectors, to the different subsets of the plurality of target users according to the predetermined drip schedule;
• collecting target user activity data, wherein the target user activity data includes data describing interactions of the one or more target users with the one or more phishing attack communications;
• identifying at-risk target users based on the collected target user activity data, wherein the at-risk target users include a set of the plurality of target users that succumbed to the one or more phishing attack communications;
• generating a phishing risk analysis of the target computer network based on the collected target user activity data;
• and wherein the configuring and/or generating the one or more test parameters of the phishing campaign includes:
• configuring at least two of the one or more phishing communication vectors to work in concert, wherein a first of the at least two phishing communication vectors includes a message that directs a target user to interact with a phishing attack communication message of a second of the at least two phishing communication vectors.