What it does. Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense. Use when building or maturing a phishing awareness program, establishing training controls for compliance, or measuring phishing susceptibility and reporting rates over time. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-anti-phishing-training-program, or copy the skill folder into ~/.claude/skills/implementing-anti-phishing-training-program/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-phishing-training-program/SKILL.md
SKILL.md (verbatim)
name: implementing-anti-phishing-training-program
description: Guides designing, deploying, and measuring an anti-phishing security awareness program - baseline phishing simulations, interactive training modules, just-in-time learning, and metric tracking - using platforms like KnowBe4, Proofpoint Security Awareness, or Cofense. Use when building or maturing a phishing awareness program, establishing training controls for compliance, or measuring phishing susceptibility and reporting rates over time.
domain: cybersecurity
subdomain: phishing-defense
tags:
- phishing
- email-security
- social-engineering
- dmarc
- awareness
- training
- security-culture
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.AT-01
- DE.CM-09
- RS.CO-02
- DE.AE-02
mitre_attack:
- T1566
- T1598
- T1534
- T1036
mitre_f3:
version: '1.1'
tactics:
- reconnaissance
- initial-access
- stealth
techniques:
- id: T1660
name: Phishing
tactic: initial-access
source: attack
- id: T1598
name: Phishing for Information
tactic: reconnaissance
source: attack
- id: T1672
name: Email Spoofing
tactic: stealth
source: attack
- id: F1032
name: Impersonate Official
tactic: initial-access
source: f3
- id: F1031
name: Impersonate Account Holder
tactic: initial-access
source: f3
Implementing Anti-Phishing Training Program
Overview
Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.
When to Use
- When deploying or configuring implementing anti phishing training program capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Management buy-in and budget approval
- Security awareness training platform (KnowBe4, Proofpoint SAT, Cofense)
- Employee email list and organizational structure
- Baseline phishing susceptibility data (from initial simulation)
- Learning management system (LMS) integration capability
Key Concepts
Training Program Pillars
- Baseline Assessment: Initial phishing simulation to measure current susceptibility
- Interactive Training: Role-based modules covering phishing identification
- Regular Simulations: Monthly/quarterly phishing tests with progressive difficulty
- Just-in-Time Learning: Immediate training after a user fails a simulation
- Positive Reinforcement: Recognition for reporting phishing correctly
- Metrics & Reporting: Track improvement over time by department and role
SANS Security Awareness Maturity Model
- Level 1: Non-existent - No program
- Level 2: Compliance-focused - Annual checkbox training
- Level 3: Promoting Awareness - Engaging, regular content
- Level 4: Long-term Sustainment - Continuous program with culture change
- Level 5: Metrics Framework - Risk-based measurement and optimization
Workflow
Step 1: Establish Baseline
- Run initial phishing simulation across all departments
- Measure click rate, submit rate, and report rate
- Identify high-risk departments and roles
Step 2: Design Curriculum
- General awareness: Phishing identification basics for all employees
- Role-specific: Finance (BEC/wire fraud), IT (credential phishing), Executives (whaling)
- Progressive difficulty: Beginner, intermediate, advanced modules
- Micro-learning: Short (3-5 minute) frequent sessions vs. annual marathon
- Configure KnowBe4/Proofpoint SAT with organizational groups
- Set up automated enrollment workflows
- Integrate with LMS for completion tracking
- Configure reporting dashboards
Step 4: Run Continuous Simulations
- Monthly simulations with varied scenarios
- Increase difficulty based on organizational performance
- Include diverse attack types: links, attachments, QR codes, BEC
Step 5: Measure and Optimize
Use scripts/process.py to analyze training completion, simulation results, and program effectiveness over time.
Validation
- 90%+ training completion rate across organization
- Measurable reduction in phishing click rate over 6 months
- Increase in user phishing report rate
- Department-level improvement tracking
Other files in this skill
assets/template.md (verbatim)
Anti-Phishing Training Program Plan Template
Program Overview
- Organization: [Company Name]
- Program Owner: [CISO / Security Awareness Manager]
- Start Date: [YYYY-MM-DD]
- Review Cycle: [Quarterly / Semi-annual]
Baseline Metrics
| Metric |
Current Value |
6-Month Target |
12-Month Target |
| Phish Click Rate |
% |
% |
<5% |
| Submit Rate |
% |
% |
<2% |
| Report Rate |
% |
% |
>60% |
| Training Completion |
% |
90% |
95% |
| Repeat Offenders |
% |
% |
<3% |
Training Curriculum
| Module |
Audience |
Duration |
Frequency |
Platform |
| Phishing Basics |
All employees |
15 min |
Annual + new hire |
|
| BEC/Wire Fraud |
Finance |
20 min |
Quarterly |
|
| Executive Threats |
C-suite/VPs |
10 min |
Quarterly |
|
| IT-Targeted Phishing |
IT Staff |
20 min |
Quarterly |
|
| Credential Protection |
All employees |
10 min |
Semi-annual |
|
| Mobile Threats (Smishing) |
All employees |
10 min |
Annual |
|
Simulation Schedule
| Month |
Scenario Type |
Difficulty |
Target Group |
| Jan |
Password reset |
Easy |
All employees |
| Feb |
Vendor invoice |
Medium |
Finance |
| Mar |
IT notification |
Easy |
All employees |
| Apr |
Package delivery |
Easy |
All employees |
| May |
Executive request |
Hard |
Finance + Admin |
| Jun |
Cloud storage share |
Medium |
All employees |
| Jul |
HR policy update |
Easy |
All employees |
| Aug |
Tax document |
Medium |
All employees |
| Sep |
Conference invite |
Medium |
All employees |
| Oct |
Security alert |
Hard |
IT Staff |
| Nov |
Benefits enrollment |
Medium |
All employees |
| Dec |
Holiday promotion |
Hard |
All employees |
Escalation Policy for Repeat Offenders
| Offense |
Action |
Responsible |
| First click |
Just-in-time training + auto-enroll in module |
Automated |
| Second click |
Enhanced training + coaching offer |
Security team |
| Third click |
Mandatory training + manager notification |
HR + Security |
| Fourth+ click |
Access review + remediation plan |
HR + IT + Security |
Budget
| Item |
Annual Cost |
| Training platform license |
$ |
| Simulation platform |
$ |
| Content development |
$ |
| Program administration |
$ |
| Rewards/recognition |
$ |
| Total |
$ |
Reporting Schedule
- Monthly: Simulation results to security team
- Quarterly: Department-level report to leadership
- Annually: Full program assessment and ROI report to board
references/api-reference.md (verbatim)
API Reference: Implementing Anti-Phishing Training Program
KnowBe4 API
import requests
headers = {"Authorization": "Bearer <API_KEY>"}
base = "https://us.api.knowbe4.com/v1"
# List users
users = requests.get(f"{base}/users", headers=headers).json()
# Get phishing campaign results
campaigns = requests.get(f"{base}/phishing/campaigns", headers=headers).json()
# Get training enrollments
enrollments = requests.get(f"{base}/training/enrollments", headers=headers).json()
Key Metrics
| Metric |
Target |
Calculation |
| Click Rate |
< 15% |
Clicked / Total Recipients |
| Submit Rate |
< 5% |
Submitted Creds / Total |
| Report Rate |
> 70% |
Reported / Total Recipients |
| Completion Rate |
> 90% |
Completed / Enrolled |
pandas Simulation Analysis
import pandas as pd
df = pd.read_csv("simulation_results.csv", parse_dates=["timestamp"])
# Department click rates
dept = df.groupby("department").agg(
click_rate=("clicked", "mean"),
report_rate=("reported", "mean"),
)
# Monthly trend
monthly = df.set_index("timestamp").resample("M")["clicked"].mean()
SANS Maturity Model Levels
| Level |
Name |
Description |
| 1 |
Non-existent |
No program |
| 2 |
Compliance |
Annual checkbox |
| 3 |
Awareness |
Engaging, regular |
| 4 |
Sustainment |
Culture change |
| 5 |
Metrics |
Risk-based optimization |
GoPhish (Open-Source Alternative)
# Launch campaign
curl -X POST https://gophish:3333/api/campaigns \
-H "Authorization: <API_KEY>" \
-d '{"name":"Q1-2025","template":{"name":"IT Alert"},"groups":[{"name":"All Staff"}]}'
References
references/standards.md (verbatim)
Standards & References: Anti-Phishing Training Program
NIST Guidelines
- NIST SP 800-50: Building an Information Technology Security Awareness and Training Program
- NIST SP 800-16: Information Technology Security Training Requirements
- NIST SP 800-53 Rev.5: AT-1 through AT-6 - Awareness and Training family
Regulatory Requirements
- PCI DSS 4.0: Requirement 12.6 - Security awareness training for all personnel
- HIPAA: 45 CFR 164.308(a)(5) - Security awareness and training
- SOX: Section 404 - Internal controls requiring security awareness
- GDPR: Article 39(1)(b) - Data protection awareness training
- CMMC 2.0: AT.L2-3.2.1/2/3 - Awareness and training practices
- FFIEC: Information Security Handbook - Security awareness training
Industry Frameworks
- SANS Security Awareness Maturity Model: Five-level maturity assessment
- AISA Phishing Resilience Protocol: Australian standard for phishing testing
- CISA Cybersecurity Awareness Program: Federal awareness guidance
MITRE ATT&CK Techniques Addressed by Training
- T1566: Phishing (all sub-techniques)
- T1598: Phishing for Information
- T1204: User Execution
- T1534: Internal Spearphishing
| KPI |
Description |
Target |
| Phish-Prone Percentage |
Users who click simulated phishing |
< 5% |
| Training Completion Rate |
Users completing assigned modules |
> 95% |
| Report Rate |
Users reporting simulated phishing |
> 70% |
| Time to Report |
Average time to report phishing |
< 5 minutes |
| Repeat Offender Rate |
Users failing multiple simulations |
< 2% |
| Training Satisfaction |
Post-training survey score |
> 4/5 |
| Knowledge Assessment Score |
Quiz/test average score |
> 85% |
Training Content Categories
- Email phishing identification
- Business email compromise (BEC)
- Spearphishing and whaling
- Vishing (voice phishing)
- Smishing (SMS phishing)
- QR code phishing (quishing)
- Social media phishing
- Credential harvesting
- Malicious attachments
- USB/physical social engineering
references/workflows.md (verbatim)
Workflows: Anti-Phishing Training Program
Workflow 1: Annual Program Lifecycle
Q1: Baseline & Planning
+-- Run baseline phishing simulation
+-- Assess current awareness maturity level
+-- Define annual targets and KPIs
+-- Select/renew training platform
+-- Design curriculum by role and department
|
Q2: Foundation Training
+-- Deploy core phishing awareness modules
+-- Run monthly simulations (easy difficulty)
+-- Launch phishing report button
+-- Begin tracking metrics
|
Q3: Advanced Training
+-- Role-specific training (finance, IT, executives)
+-- Increase simulation difficulty
+-- Recognize security champions
+-- Mid-year metrics review
|
Q4: Assessment & Optimization
+-- Run year-end assessment simulation
+-- Compare against baseline
+-- Generate annual report
+-- Identify gaps for next year
+-- Present ROI to leadership
Workflow 2: Just-in-Time Training Flow
User interacts with simulated phishing email
|
v
[Did user click the link?]
|
+-- NO (ignored or reported) --> Positive outcome tracked
| |
| +-- [Did user report it?]
| +-- YES --> Send congratulations, award points
| +-- NO --> No action (not a failure)
|
+-- YES (clicked link)
|
v
[Landing page shows "This was a test"]
|
v
[Immediate micro-training module (2-3 min)]
+-- What red flags were present
+-- How to identify similar emails
+-- How to report suspicious emails
|
v
[Auto-enroll in refresher course within 7 days]
|
v
[Manager receives aggregate report (not individual names)]
|
v
[User included in next simulation cycle]
Workflow 3: Repeat Offender Escalation
User fails first simulation
|
+-- Standard just-in-time training
+-- Auto-enrolled in awareness module
|
User fails second simulation (within 6 months)
|
+-- Enhanced training assignment
+-- One-on-one coaching session offered
+-- Manager notification (private)
|
User fails third simulation
|
+-- Mandatory extended training
+-- Access restrictions considered (additional MFA, restricted permissions)
+-- HR involvement per policy
+-- Monthly targeted simulations
|
User passes subsequent simulation
|
+-- Return to normal simulation schedule
+-- Positive reinforcement
Workflow 4: Metrics-Driven Optimization
Monthly Data Collection
|
+-- Simulation results (click, submit, report rates)
+-- Training completion rates
+-- User-reported real phishing volume
+-- Help desk phishing tickets
|
v
[Analyze by dimensions]
+-- Department breakdown
+-- Role/seniority breakdown
+-- Location breakdown
+-- Trend over time
|
v
[Identify patterns]
+-- Which departments are improving?
+-- Which scenarios are most effective?
+-- Are repeat offenders decreasing?
+-- Is report rate increasing?
|
v
[Adjust program]
+-- Increase difficulty for high-performing groups
+-- More training for struggling departments
+-- New scenario types for common gaps
+-- Update content for new threat trends
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.