Abstract: An electronic device will identify an electronic message received by a messaging client that is associated with a first recipient, and it will analyze the electronic message to determine whether the electronic message is a simulated malicious message. Upon determining that electronic message is a simulated malicious message, the device will identify an actuatable element in the electronic message. The actuatable element will include a service address. The device will modify the electronic message by appending a user identifier of the first recipient to the service address of the actuatable element. Then, when the actutable element is actuated, the system may determine whether the first recipient actuated the actuatable element or an alternate recipient did so based on whether the user identifier of the first recipient is still appended (or is the only user identifier appended) to the actuatable element.

Abstract: An electronic messaging system includes a messaging server that identifies a recipient for an electronic message. The messaging system sends the recipient an electronic message that includes instrumented content. A web server monitors activity and determines whether interaction occurred with the instrumented content. The web server determines whether a sandbox intercepted the message based on whether interaction occurred, or did not occur, with the instrumented content within a threshold time period or with one or more activity characteristics.

Abstract: A system manages computer security risks associated with message file attachments. When a user of an electronic device with a messaging client attempts to open an attachment to a message that is in the client's inbox, the system will analyze the message to determine whether the message is a legitimate message or a potentially malicious message without the need to actually process or analyze the attachment itself. If the system determines that the received message is a legitimate message, the system will permit the attachment to actuate on the client computing device. If the system determines that the received message is not or may not be a legitimate message, the system will continue preventing the attachment from actuating on the client computing device.

Abstract: A client electronic device of an electronic message analysis system receives a user activation action indicating that a user has reported a message received at the client device a potentially malicious. The client device then determines whether to forward the message to a remote service for analysis by assessing whether the received message originated from a trusted sender. If and only if the client device determines that the received message originated from a trusted sender, it will permit the client device to take other action on the received message and not report the received message to a remote service for further analysis. If the client device does not determine that the received message originated from a trusted sender, it will report the received message to a remote service for further analysis.

Abstract: A system manages computer security risks associated with message file attachments. When a user of an electronic device with a messaging client attempts to open an attachment to a message that is in the client's inbox, the system will analyze the message to determine whether the message is a legitimate message or a potentially malicious message without the need to actually process or analyze the attachment itself. If the system determines that the received message is a legitimate message, the system will permit the attachment to actuate on the client computing device. If the system determines that the received message is not or may not be a legitimate message, the system will continue preventing the attachment from actuating on the client computing device.

Abstract: An electronic messaging system includes a messaging server that identifies a recipient for an electronic message. The messaging system sends the recipient an electronic message that includes instrumented content. A web server monitors activity and determines whether interaction occurred with the instrumented content. The web server determines whether a sandbox intercepted the message based on whether interaction occurred, or did not occur, with the instrumented content within a threshold time period or with one or more activity characteristics.

Abstract: A system assesses the susceptibility of an electronic device user to a cybersecurity threat by sensing a user action with respect to the electronic device. The system maps the sensed data to a training needs model to determine whether the sensed data corresponds to a pattern associated with a threat scenario in the training needs model. When the system determines that the sensed data corresponds to a pattern associated with a threat scenario in the training needs model, identify a cybersecurity threat scenario for which the user is at risk, and use the training needs model to estimate susceptibility of the user to the cybersecurity threat scenario.

Abstract: A system assesses the susceptibility of an electronic device user to a cybersecurity threat by identifying information relating to the user of an electronic device, selecting a mock attack, and causing the mock attack to be deployed to the user so that the user receives the mock attack in the user's regular context of use of the electronic device. When a sensor detects a user action that the user has interacted with the electronic device in response to the mock attack, the system will record the sensed user action and use the sensed user action to determine the susceptibility of the user to a cybersecurity threat. In some embodiments, the lack of user action in response to a mock attack also may be used to determine the user's susceptibility to a cybersecurity threat.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise electronic device security. The system includes a library of cybersecurity training actions and a library of brand items. The system retrieves a template for a cybersecurity training action from the first library, automatically modifies the retrieved template to include a brand or branded content from the second library, and causes the cybersecurity training action according to the modified template instantiated with the branded content to be sent to the user's electronic device.

Abstract: An electronic message analysis system of a cybersecurity network assesses whether a received message is a mock malicious message in response to, receiving a user activation action that indicates that the user has reported the received message as a potentially malicious message. The system does this by determining whether any header field of a header section of the message starts with a predetermined key. For any header field that starts with the predetermined key, the system determines whether a value that follows the predetermined key satisfies a trusted sender rule. If the value that follows the predetermined key satisfies the trusted sender rule, the system determines that the received message originated from a trusted sender. If the value that immediately follows the predetermined key does not satisfy the trusted sender rule, the system determines that the received message did not originate from a trusted sender.

Abstract: In a cybersecurity network, a system identifies and classifies non-malicious messages by receiving a user notification indicating that the user has reported a received message as potentially malicious message, and determining whether the received message is legitimate or potentially malicious. When the system determines that the message is a legitimate, it further analyzes the message to assign a class that may include trusted internal sender, trusted external sender, or training a simulated phishing message. It will then cause the user's device to provide the user with information corresponding to the assigned class. The system may also quarantine a received message and release the message from the quarantine only after determining that the message is legitimate and receiving a user acknowledgment.

Abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.

Abstract: Context-aware training systems, apparatuses and systems. The context-aware training systems, apparatuses and systems are computer-implemented and include sensing a user action and, based on a training needs model, estimating a cost or benefit to exposing the user to a training action, selecting a training action from a collection of available training actions and delivering the training action to the user if the user action indicates a need for the user to be trained and the cost or benefit to exposing the user to the training action indicates user exposure to the training action is warranted.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise security. The system includes an administrator interface by which an administrator may customize a lure and/or a training action with branded content. When used in a lure, this enables the lure to appear to the user as if it were a legitimate, non-threatening action from the brand. If the user falls for the lure, the system may provide the user with cybersecurity training, which may automatically include content that is tailored for the selected brand.

Abstract: A context-aware training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user or a group of users. The system includes an administrator interface that enables an administrator to select, customize and/or assign constraints to the training action that will be delivered to the user(s).

Abstract: A context-aware training system senses sensing a user action that may expose the user's computer to a cybersecurity threat. The system selects training action from a collection of available training actions and causes the training action to be selected to the user.

Abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.

Abstract: A context-aware training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user or a group of users. The system includes an administrator interface that enables an administrator to select, customize and/or assign constraints to the training action that will be delivered to the user(s).

Abstract: A context-aware training system senses sensing a user action that may expose the user's computer to a cybersecurity threat. The system selects training action from a collection of available training actions and causes the training action to be selected to the user.

Abstract: Various embodiments are directed to a computer implemented method for updating a policy that is enforced by a computer program. In one embodiment, a computer communicates, to a user, data regarding one or more decisions made by the program over a period of time according to a policy. Each decision is made on the particular policy in force at the time the decision is made. Policy data for the policy is stored in a machine readable format. The user feedback data indicative of feedback by the user regarding the one or more decisions is stored. The computer identifies and ranks one or more potential variations to the policy based on a score of an objective function for each potential variation. The computer communicates, to the user, one or more suggested modifications based on the ranking of the one or more potential variations to the policy. The computer modifies the policy data based on one or more selections by the user in response to the transmission of the one or more suggested modifications.