Abstract: A security awareness training system can include a recognition module, a mapping module, a customized training module, and an authentication module. The recognition module can detect when behavioral activity by an end user on an endpoint device creates one or more of i) a model breach indicative of a potential cyber threat and ii) a violation of a network policy, an email policy, or a cloud policy. The authentication module can cooperate with the recognition module to provide just-in-time cyber security awareness training on a display screen of the endpoint device associated with that specific end user, at a time when the behavioral activity by the end user on the endpoint device creates the one or more of i) the model breach indicative of the potential cyber threat and ii) the violation of the network policy, the email policy, or the cloud policy.

Abstract: In an embodiment, an apparatus is described. The apparatus comprises an appliance extension configured to perform functions with i) a monitoring module configured to monitor metrics and receive alerts regarding potential cyber threats on a system including an email system, ii) an investigative module configured to retrieve the metrics and alerts, and iii) a remote response module configured observe the metrics and alerts and send one or more control signals to an autonomous response module to take one or more actions to counter one or more detected cyber threats on the system remotely from the appliance extension.