Systems and methods for subscription management of specific classification groups based on user's actions

Patent metadata

Field	Value
Publication number	US-11792225-B2
Application number	US-202217978115-A
Country	US
Kind code	B2
Filing date	Oct 31, 2022
Priority date	Apr 6, 2017
Publication date	Oct 17, 2023
Grant date	Oct 17, 2023

Abstract

Embodiments of the disclosure describe systems and methods for selecting a first group of users, which is selected to receive simulated phishing emails as part of a simulated phishing campaign, and adding users to a second group of users based upon those selected users interacting with a simulated phishing email that is part of a simulated phishing campaign; tracking the completion of remediation training related to phishing emails by users in the second group of users and receiving one or more indications that the users in the second group of users have completed remedial training; and automatically adding users, who are members of the second user group, to the first user group, to a third user group, or to a predetermined user group responsive to the one or more indications that the users in the second group of users have completed remedial training.

First claim

What is claimed is:

1. A method comprising:
communicating, by one or more processors, a plurality of simulated phishing communications to one or more users of a first user group of a plurality of user groups;
tracking, by the one or more processors, an amount of time since a user of the one or more users has interacted with a simulated phishing communication of the plurality of simulated phishing communications;
detecting, by the one or more processors, an event in connection with the user, wherein the event comprises an indication that the amount of time has at least reached a predetermined threshold; and
including, by the one or more processors responsive to the indication, the user from the first user group in a second user group of the plurality of user groups.

2. The method of claim 1 , further comprising tracking, by the one or more processors, the amount of time between the user interacting with the simulated phishing communication and the user interacting with a second simulated phishing communication of the plurality of simulated phishing communications.

3. The method of claim 1 , further comprising tracking, by the one or more processors, a number of times the user has interacted with any of the plurality of simulated phishing communications.

4. The method of claim 3 , further comprising including, by the one or more processors, the user in one of the plurality of user groups to be provided electronic remediation training responsive to the number of times reaching at least a predetermined threshold.

5. The method of claim 1 , further comprising moving, by the one or more processors responsive to the indication, the user from the first user group to the second user group.

6. The method of claim 1 , further comprising keeping, by the one or more processors responsive to the indication, the user in the first group user while including the user in the second user group.

7. The method of claim 1 , further comprising identifying, by the one or more processors, the first user group for which to communicate the plurality of simulated phishing communications of one or more simulated phishing campaigns.

8. The method of claim 1 , further comprising communicating, by the one or more processors, a second one or more simulated phishing communications to at least the user of the second user group.

9. The method of claim 1 , wherein the second user group is designated for communicating one of further simulated phishing campaigns or electronic remediation training.

10. A system comprising:
one or more processors, coupled to non-transitory memory and configured to:
communicate a plurality of simulated phishing communications to one or more users of a first user group of a plurality of user groups;
track an amount of time since a user of the one or more users has interacted with a simulated phishing communication of the plurality of simulated phishing communications;
detect an event in connection with the user, wherein the event comprises an indication that the amount of time has at least reached a predetermined threshold; and
include, responsive to the indication, the user from the first user group in a second user group of the plurality of user groups.

11. The system of claim 10 , wherein the one or more processors are further configured to track the amount of time between the user interacting with the simulated phishing communication and the user interacting with a second simulated phishing communication of the plurality of simulated phishing communications.

12. The system of claim 10 , wherein the one or more processors are further configured to track a number of times the user has interacted with any of the plurality of simulated phishing communications.

13. The system of claim 12 , wherein the one or more processors are further configured to include the user in one of the plurality of user groups to be provided electronic remediation training responsive to the number of times reaching at least a predetermined threshold.

14. The system of claim 10 , wherein the one or more processors are further configured to move, responsive to the indication, the user from the first user group to the second user group.

15. The system of claim 10 , wherein the one or more processors are further configured to keep, responsive to the indication, the user in the first group user while including the user in the second user group.

16. The system of claim 10 wherein the one or more processors are further configured to identify the first user group for which to communicate the plurality of simulated phishing communications of one or more simulated phishing campaigns.

17. The system of claim 10 , wherein the one or more processors are further configured to communicate a second one or more simulated phishing communications to at least the user of the second user group.

18. The system of claim 10 , wherein the second user group is designated for communicating one of further simulated phishing campaigns or electronic remediation training.

Assignees

• Knowbe4 Inc

Inventors

• Kras Greg
• Irimie Alin

Classifications

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title