Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Implementing Anti-Phishing Training Program · mukul975 | DecimalAI

Implementing Anti Phishing Training Program

SkillScore18Maintained

implementing-anti-phishing-training-program

Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positiv

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/implementing-anti-phishing-training-program/SKILL.md

decimalai skills pull implementing-anti-phishing-training-program --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/implementing-anti-phishing-training-program/SKILL.md https://app.decimal.ai/s/implementing-anti-phishing-training-program/SKILL.md

Raw file: /s/implementing-anti-phishing-training-program/SKILL.md ↗ · machine-readable summary at /s/implementing-anti-phishing-training-program.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +14% lift+15% tokens0% turns18% of whole cases pass with skill (4/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-16	✗→✓	▲ Improved	—	—
case-13	✗→✓	▲ Improved	—	—
case-18	✗→✓	▲ Improved	—	—
case-02	✓→✓	＝ Same ✓	—	—
case-22	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/implementing-anti-phishing-training-program/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Implementing Anti-Phishing Training Program

Overview

Security awareness training is the human layer of phishing defense. An effective anti-phishing training program combines regular simulations, interactive learning modules, metric tracking, and positive reinforcement to build a security-conscious culture. This skill covers designing, deploying, and measuring a comprehensive phishing awareness program using platforms like KnowBe4, Proofpoint Security Awareness, and open-source alternatives.

When to Use

When deploying or configuring implementing anti phishing training program capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Management buy-in and budget approval
Security awareness training platform (KnowBe4, Proofpoint SAT, Cofense)
Employee email list and organizational structure
Baseline phishing susceptibility data (from initial simulation)
Learning management system (LMS) integration capability

Key Concepts

Training Program Pillars

Baseline Assessment: Initial phishing simulation to measure current susceptibility
Interactive Training: Role-based modules covering phishing identification
Regular Simulations: Monthly/quarterly phishing tests with progressive difficulty
Just-in-Time Learning: Immediate training after a user fails a simulation
Positive Reinforcement: Recognition for reporting phishing correctly
Metrics & Reporting: Track improvement over time by department and role

SANS Security Awareness Maturity Model

Level 1: Non-existent - No program
Level 2: Compliance-focused - Annual checkbox training
Level 3: Promoting Awareness - Engaging, regular content
Level 4: Long-term Sustainment - Continuous program with culture change
Level 5: Metrics Framework - Risk-based measurement and optimization

Workflow

Step 1: Establish Baseline

Run initial phishing simulation across all departments
Measure click rate, submit rate, and report rate
Identify high-risk departments and roles

Step 2: Design Curriculum

General awareness: Phishing identification basics for all employees
Role-specific: Finance (BEC/wire fraud), IT (credential phishing), Executives (whaling)
Progressive difficulty: Beginner, intermediate, advanced modules
Micro-learning: Short (3-5 minute) frequent sessions vs. annual marathon

Step 3: Deploy Training Platform

Configure KnowBe4/Proofpoint SAT with organizational groups
Set up automated enrollment workflows
Integrate with LMS for completion tracking
Configure reporting dashboards

Step 4: Run Continuous Simulations

Monthly simulations with varied scenarios
Increase difficulty based on organizational performance
Include diverse attack types: links, attachments, QR codes, BEC

Step 5: Measure and Optimize

Use scripts/process.py to analyze training completion, simulation results, and program effectiveness over time.

Tools & Resources

KnowBe4: https://www.knowbe4.com/
Proofpoint Security Awareness: https://www.proofpoint.com/us/products/security-awareness-training
Cofense PhishMe: https://cofense.com/
SANS Security Awareness: https://www.sans.org/security-awareness-training/
Terranova Security: https://terranovasecurity.com/

Validation

90%+ training completion rate across organization
Measurable reduction in phishing click rate over 6 months
Increase in user phishing report rate
Department-level improvement tracking

Illustrative Want to see what implementing-anti-phishing-training-program would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 08:36 UTC · 22 cases

Lift

+14%

18% vs 5%

Agent turns

0%

1.0 vs 1.0

Tokens

+15%

2,274.55 vs 1,975.18

fail → pass · 3pass → pass · 1fail → fail · 18

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-16 We have finished gathering simulation results and training completion logs across departments. How should these metrics be processed and analyzed according to our standard administrative tooling?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 We are configuring Microsoft Defender for Office 365 in Exchange Online. How do we create a Safe Links policy to rewrite and inspect URLs in incoming external emails at time-of-click?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 When designing our general employee phishing awareness curriculum, leadership wants an annual 2-hour comprehensive classroom seminar. Provide a training schedule recommendation that maximizes retention and engagement.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-03 We are tailoring our anti-phishing training curriculum by department. For the finance team, our trainer suggested focusing on generic phishing links like fake cloud storage login pages. What specific threat topics should be prioritized for finance personnel?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 To track employee training completions, our coordinator proposes having employees email PDF certificates to HR to be manually recorded in spreadsheets. What system integration should be configured for completion tracking?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When an employee clicks a link during a simulated phishing exercise, our HR policy recommends scheduling them for an annual compliance retake class at the end of the quarter. How should post-failure learning be structured to maximize learning impact?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Our security engineer wants to launch our first monthly phishing simulation campaign using complex multi-stage spear-phishing templates to test maximum user resilience immediately. How should simulation difficulty be calibrated over time?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 To discourage employees from ignoring phishing simulation emails, leadership wants to publicly display a list of employees who failed the test. How should employee response to phishing be handled to build security culture?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We need to secure our corporate domain against email spoofing. How do we configure a DNS TXT record for DMARC with a strict rejection policy for domain protection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Under the SANS Security Awareness Maturity Model, our organization conducts an annual mandatory 30-minute slide deck completion for compliance. An auditor claims this puts us at Maturity Level 3. How should Level 2 vs Level 3 be classified?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 Our team plans to conduct all monthly phishing simulations using only standard hyperlinked emails to maintain consistent baseline data. What attack vectors should be incorporated into simulation campaigns?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When evaluating phishing simulation campaign metrics, our team is only tracking click rate and credential submission rate. What critical positive metric must also be tracked to evaluate user engagement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 When presenting our anti-phishing program goals to the board, we need to specify an evaluation timeframe for measuring click rate reduction. What timeframe should be established to measure sustained click rate reduction?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We are launching an enterprise anti-phishing initiative. The team suggests delivering our security awareness video modules first so employees perform well on their first phishing simulation. Outline the initial workflow steps for establishing our program metrics.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Our executive leadership team claims standard phishing training doesn't apply to them because they only handle high-level strategy. What specialized phishing attack vector should be the focal topic when building curriculum for C-suite executives?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 For our IT and system administration team's security awareness module, the committee proposed training them on basic spam filtering rules. What high-risk phishing vector should be emphasized for IT staff?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 Our management proposes running phishing simulations once per year during Cybersecurity Awareness Month in October to avoid distracting employees. What simulation schedule frequency should be implemented?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 We are setting Key Performance Indicators for our organization-wide security awareness platform deployment. A manager suggests setting a 70% training completion target. What completion rate target should be established?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 Our security team wants to reach the highest level (Level 5) of the SANS Security Awareness Maturity Model. They believe installing an automated email gateway reaches this level. What defines Level 5 in this model?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 When evaluating baseline phishing simulation results, our analyst plans to aggregate all employee clicks into a single company-wide percentage and discard department labels. How should baseline results be processed?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 In our role-based training matrix, we need to define specific attack types for executive leadership. What specific phishing variant targets high-profile executives for sensitive data or wire transfers?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 Our SOC received a suspicious email attachment containing an obfuscated VBA macro in a Microsoft Word document. What steps should be taken in a sandbox environment to extract and analyze the macro payload?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 18.2%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 1
Skill version measured: v1
Run completed: 7/28/2026, 08:36 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run18

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+38% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.