Abstract: A system assesses the susceptibility of an electronic device user to a cybersecurity threat by identifying information relating to the user of an electronic device, selecting a mock attack, and causing the mock attack to be deployed to the user so that the user receives the mock attack in the user's regular context of use of the electronic device. When a sensor detects a user action that the user has interacted with the electronic device in response to the mock attack, the system will record the sensed user action and use the sensed user action to determine the susceptibility of the user to a cybersecurity threat. In some embodiments, the lack of user action in response to a mock attack also may be used to determine the user's susceptibility to a cybersecurity threat.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise electronic device security. The system includes a library of cybersecurity training actions and a library of brand items. The system retrieves a template for a cybersecurity training action from the first library, automatically modifies the retrieved template to include a brand or branded content from the second library, and causes the cybersecurity training action according to the modified template instantiated with the branded content to be sent to the user's electronic device.

Abstract: An electronic message analysis system of a cybersecurity network assesses whether a received message is a mock malicious message in response to, receiving a user activation action that indicates that the user has reported the received message as a potentially malicious message. The system does this by determining whether any header field of a header section of the message starts with a predetermined key. For any header field that starts with the predetermined key, the system determines whether a value that follows the predetermined key satisfies a trusted sender rule. If the value that follows the predetermined key satisfies the trusted sender rule, the system determines that the received message originated from a trusted sender. If the value that immediately follows the predetermined key does not satisfy the trusted sender rule, the system determines that the received message did not originate from a trusted sender.

Abstract: In a cybersecurity network, a system identifies and classifies non-malicious messages by receiving a user notification indicating that the user has reported a received message as potentially malicious message, and determining whether the received message is legitimate or potentially malicious. When the system determines that the message is a legitimate, it further analyzes the message to assign a class that may include trusted internal sender, trusted external sender, or training a simulated phishing message. It will then cause the user's device to provide the user with information corresponding to the assigned class. The system may also quarantine a received message and release the message from the quarantine only after determining that the message is legitimate and receiving a user acknowledgment.

Abstract: Various embodiments assess security risks of users in computing networks. In some embodiments, an interaction item is sent to an end user electronic device. When the end user interacts with the interaction item, the system collects feedback data that includes information about the user's interaction with the interaction item, as well as technical information about the electronic device. The feedback is compared to a plurality of security risk scoring metrics. Based on this comparison, a security risk score for the user with respect to a computing network.

Abstract: A system assesses the susceptibility of an electronic device user to a cybersecurity threat by sensing a user action with respect to the electronic device. The system maps the sensed data to a training needs model to determine whether the sensed data corresponds to a pattern associated with a threat scenario in the training needs model. When the system determines that the sensed data corresponds to a pattern associated with a threat scenario in the training needs model, identify a cybersecurity threat scenario for which the user is at risk, and use the training needs model to estimate susceptibility of the user to the cybersecurity threat scenario.

Abstract: A system assessing the susceptibility of an electronic device user to a cybersecurity threat by identifying information relating to the user of an electronic device, selecting a mock attack, and causing the mock attack to be deployed to the user so that the user receives the mock attack in the user's regular context of use of the electronic device. When the a sensor detects a user action that the user has interacted with the electronic device in response to the mock attack, the system will record the sensed user action and us the sensed user action to determine the susceptibility of the user to a cybersecurity threat. In some embodiments, the lack of user action in response to a mock attack also may be used to determine the user's susceptibility to a cybersecurity threat.

Abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.

Abstract: Context-aware training systems, apparatuses and systems. The context-aware training systems, apparatuses and systems are computer-implemented and include sensing a user action and, based on a training needs model, estimating a cost or benefit to exposing the user to a training action, selecting a training action from a collection of available training actions and delivering the training action to the user if the user action indicates a need for the user to be trained and the cost or benefit to exposing the user to the training action indicates user exposure to the training action is warranted.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise electronic device security. The system includes a library of cybersecurity training actions and a library of brand items. The system retrieves a template for a cybersecurity training action from the first library, automatically modifies the retrieved template to include a brand or branded content from the second library, and causes the cybersecurity training action according to the modified template instantiated with the branded content to be sent to the user's electronic device.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise security. The system includes an administrator interface by which an administrator may customize a lure and/or a training action with branded content. When used in a lure, this enables the lure to appear to the user as if it were a legitimate, non-threatening action from the brand. If the user falls for the lure, the system may provide the user with cybersecurity training, which may automatically include content that is tailored for the selected brand.

Abstract: A context-aware training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user or a group of users. The system includes an administrator interface that enables an administrator to select, customize and/or assign constraints to the training action that will be delivered to the user(s).

Abstract: A context-aware training system senses sensing a user action that may expose the user's computer to a cybersecurity threat. The system selects training action from a collection of available training actions and causes the training action to be selected to the user.

Abstract: A cybersecurity training system uses lures and training actions to help train a user of an electronic device to recognize and act appropriately in situations that could compromise security. The system includes an administrator interface by which an administrator may customize a lure and/or a training action with branded content. When used in a lure, this enables the lure to appear to the user as if it were a legitimate, non-threatening action from the brand. If the user falls for the lure, the system may provide the user with cybersecurity training, which may automatically include content that is tailored for the selected brand.

Abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.

Abstract: A context-aware training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user or a group of users. The system includes an administrator interface that enables an administrator to select, customize and/or assign constraints to the training action that will be delivered to the user(s).

Abstract: Various embodiments are directed to a computer implemented method for updating a policy that is enforced by a computer program. In one embodiment, a computer communicates, to a user, data regarding one or more decisions made by the program over a period of time according to a policy. Each decision is made on the particular policy in force at the time the decision is made. Policy data for the policy is stored in a machine readable format. The user feedback data indicative of feedback by the user regarding the one or more decisions is stored. The computer identifies and ranks one or more potential variations to the policy based on a score of an objective function for each potential variation. The computer communicates, to the user, one or more suggested modifications based on the ranking of the one or more potential variations to the policy. The computer modifies the policy data based on one or more selections by the user in response to the transmission of the one or more suggested modifications.

Abstract: Context-aware training systems, apparatuses and systems. The context-aware training systems, apparatuses and systems are computer-implemented and include sensing a user action and, based on a training needs model, estimating a cost or benefit to exposing the user to a training action, selecting a training action from a collection of available training actions and delivering the training action to the user if the user action indicates a need for the user to be trained and the cost or benefit to exposing the user to the training action indicates user exposure to the training action is warranted.

Abstract: Various embodiments are directed to a computer implemented method for updating a policy that is enforced by a computer program. In one embodiment, a computer communicates, to a user, data regarding one or more decisions made by the program over a period of time according to a policy. Each decision is made on the particular policy in force at the time the decision is made. Policy data for the policy is stored in a machine readable format. The user feedback data indicative of feedback by the user regarding the one or more decisions is stored. The computer identifies and ranks one or more potential variations to the policy based on a score of an objective function for each potential variation. The computer communicates, to the user, one or more suggested modifications based on the ranking of the one or more potential variations to the policy. The computer modifies the policy data based on one or more selections by the user in response to the transmission of the one or more suggested modifications.