Abstract: A threat management facility generates a simulated phishing threat based on one or more characteristics of a network user. Based on whether the user fails to respond appropriately to the simulated phishing threat, the threat management facility may implement one or more prophylactic measures to remediate the security weakness exposed by the user's failure to respond appropriately to the simulated phishing threat. For example, a security policy for an endpoint associated with the user may be adjusted to address the security weakness. Additionally, or alternatively, the user may be enrolled in training directed at reducing the likelihood that the user will be the victim of an actual phishing attack in the future.