# Implementing Anti Phishing Training Program

> Use when security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv. Use when working with implementing anti phishing training program.

- Skill: `oyi77/implementing-anti-phishing-training-program` (Agent Skill)
- Install (CLI): `npx skillmds add oyi77/implementing-anti-phishing-training-program`
- Raw SKILL.md: https://api.skillmd.com/api/skills/oyi77/implementing-anti-phishing-training-program/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: oyi77 (https://skillmd.com/u/oyi77)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/oyi77/implementing-anti-phishing-training-program

---


# Implementing Anti-Phishing Training Program

## Overview
Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.


## When to Use
**Trigger phrases:**
- "implementing anti phishing training program"
- "Security awareness training is the human layer of phishing defense"


- When deploying or configuring implementing anti phishing training program capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation

## Prerequisites
- Management buy-in and budget approval
- Security awareness training platform (KnowBe4, Proofpoint SAT, Cofense)
- Employee email list and organizational structure
- Baseline phishing susceptibility data (from initial simulation)
- Learning management system (LMS) integration capability

## Key Concepts

This section covers key concepts for implementing anti phishing training program.

- Ensure all prerequisites are met before proceeding
- Follow the documented workflow steps in sequence
- Record results and any anomalies encountered during this phase
### Training Program Pillars
1. **Baseline Assessment**: Initial phishing simulation to measure current susceptibility
2. **Interactive Training**: Role-based modules covering phishing identification
3. **Regular Simulations**: Monthly/quarterly phishing tests with progressive difficulty
4. **Just-in-Time Learning**: Immediate training after a user fails a simulation
5. **Positive Reinforcement**: Recognition for reporting phishing correctly
6. **Metrics & Reporting**: Track improvement over time by department and role

### SANS Security Awareness Maturity Model
- **Level 1**: Non-existent - No program
- **Level 2**: Compliance-focused - Annual checkbox training
- **Level 3**: Promoting Awareness - Engaging, regular content
- **Level 4**: Long-term Sustainment - Continuous program with culture change
- **Level 5**: Metrics Framework - Risk-based measurement and optimization

## Workflow

```python
# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}
```

1. **Scope the task** — define objectives, boundaries, and success criteria
2. **Gather information** — collect all necessary data and context before proceeding
3. **Execute the core workflow** — follow the domain-specific steps methodically
4. **Validate results** — verify outputs against expected outcomes or baselines
5. **Document findings** — record results, anomalies, and recommendations
### Step 1: Establish Baseline
- Run initial phishing simulation across all departments
- Measure click rate, submit rate, and report rate
- Identify high-risk departments and roles

### Step 2: Design Curriculum
- **General awareness**: Phishing identification basics for all employees
- **Role-specific**: Finance (BEC/wire fraud), IT (credential phishing), Executives (whaling)
- **Progressive difficulty**: Beginner, intermediate, advanced modules
- **Micro-learning**: Short (3-5 minute) frequent sessions vs. annual marathon

### Step 3: Deploy Training Platform
- Configure KnowBe4/Proofpoint SAT with organizational groups
- Set up automated enrollment workflows
- Integrate with LMS for completion tracking
- Configure reporting dashboards

### Step 4: Run Continuous Simulations
- Monthly simulations with varied scenarios
- Increase difficulty based on organizational performance
- Include diverse attack types: links, attachments, QR codes, BEC

### Step 5: Measure and Optimize
Use `scripts/process.py` to analyze training completion, simulation results, and program effectiveness over time.

## When NOT to Use

- You need to test the implementation (use performing-* skills)
- Task is about configuring existing tools (use configuring-* skills)
- You need to analyze security events (use analyzing-* skills)
- Task is about building detection rules (use building-* skills)
- You don't have access to the target environment
- Task requires vendor-specific expertise (consult vendor docs)


## Red Flags

- Performing actions without explicit written authorization from the asset owner
- Testing against production systems without a defined scope and rules of engagement
- Sharing sensitive findings or credentials in unencrypted communications
- Failing to properly scope and contain the assessment before starting

## Verification

- All steps executed successfully against a test environment before production use
- Output documented with screenshots or logs demonstrating expected behavior
- Results validated against known-good baselines or reference implementations
- Documentation complete enough for another analyst to reproduce findings

## Tools & Resources
- **KnowBe4**: https://www.knowbe4.com/
- **Proofpoint Security Awareness**: https://www.proofpoint.com/us/products/security-awareness-training
- **Cofense PhishMe**: https://cofense.com/
- **SANS Security Awareness**: https://www.sans.org/security-awareness-training/
- **Terranova Security**: https://terranovasecurity.com/

## Validation
- 90%+ training completion rate across organization
- Measurable reduction in phishing click rate over 6 months
- Increase in user phishing report rate
- Department-level improvement tracking

## Process

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

## Anti-Rationalization Table

| Rationalization | Reality |
|---|---|
| "We are too small to be targeted" | Automated attacks target everyone. Size does not matter. |
| "Security slows us down" | A breach slows you down 100x more. Build security in from the start. |
| "We will fix it after launch" | Vulnerabilities in production are exploited within hours. Fix before deploy. |