Cybersecurity enforcement using synthetic phishing

Patent metadata

Field	Value
Publication number	US-2025286909-A1
Application number	US-202418596037-A
Country	US
Kind code	A1
Filing date	Mar 5, 2024
Priority date	Mar 5, 2024
Publication date	Sep 11, 2025
Grant date	—

Abstract

In some implementations, a cybersecurity enforcement system may generate a synthetic phishing attempt targeting a user. The cybersecurity enforcement system may update, based at least in part on a mode of the synthetic phishing attempt, a risk profile specific to the user.

First claim

What is claimed is:

1 . A system for cybersecurity enforcement, the system comprising:
one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to:
generate a synthetic phishing attempt that targets a user via a communication mode of the synthetic phishing attempt;
identify a user response or non-response to the synthetic phishing attempt; and
update, based at least in part on the communication mode of the synthetic phishing attempt and the user response or non-response, a risk score specific to the user.

2 . The system of claim 1 , wherein the communication mode of the synthetic phishing attempt includes one or more of email, phone, or text.

3 . The system of claim 1 , wherein the one or more processors are further configured to:
receive an indication that the user has opted in to synthetic phishing attempts.

4 . The system of claim 1 , wherein the one or more processors are further configured to:
generate the synthetic phishing attempt based at least in part on a previous phishing attempt targeting the user.

5 . The system of claim 1 , wherein the risk score is specific to the communication mode of the synthetic phishing attempt.

6 . The system of claim 1 , wherein the one or more processors are further configured to:
perform a cybersecurity action based at least in part on the risk score.

7 . A method of cybersecurity enforcement, comprising:
generating a synthetic phishing attempt that targets a user via a communication mode of the synthetic phishing attempt; and updating, based at least in part on the communication mode of the synthetic phishing attempt, a risk profile specific to the user.

8 . The method of claim 7 , wherein the communication mode of the synthetic phishing attempt includes one or more of email, phone, or text.

9 . The method of claim 7 , further comprising:
receiving an indication that the user has opted in to synthetic phishing attempts.

10 . The method of claim 7 , further comprising:
generating the synthetic phishing attempt based at least in part on a previous phishing attempt targeting the user.

11 . The method of claim 7 , wherein updating the risk profile includes updating the risk profile based at least in part on a user response or non-response to the synthetic phishing attempt.

12 . The method of claim 7 , wherein the risk profile includes a risk score that is specific to the communication mode of the synthetic phishing attempt.

13 . The method of claim 7 , further comprising:
performing a cybersecurity action based at least in part on the risk profile.

14 . A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a cybersecurity enforcement system, cause the cybersecurity enforcement system to:
generate a synthetic phishing attempt that targets a user via a communication mode of the synthetic phishing attempt; and
update, based at least in part on the communication mode of the synthetic phishing attempt, a risk score specific to the user.

15 . The non-transitory computer-readable medium of claim 14 , wherein the communication mode of the synthetic phishing attempt includes one or more of email, phone, or text.

16 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions further cause the cybersecurity enforcement system to:
receive an indication that the user has opted in to synthetic phishing attempts.

17 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions further cause the cybersecurity enforcement system to:
generate the synthetic phishing attempt based at least in part on a previous phishing attempt targeting the user.

18 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions, that cause the cybersecurity enforcement system to update the risk score, cause the cybersecurity enforcement system to update the risk score based at least in part on a user response or non-response to the synthetic phishing attempt.

19 . The non-transitory computer-readable medium of claim 14 , wherein the risk score is specific to the communication mode of the synthetic phishing attempt.

20 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions further cause the cybersecurity enforcement system to:
perform a cybersecurity action based at least in part on the risk score.

Assignees

• Capital One Services Llc

Inventors

• Goodsitt Jeremy
• Sharpe Samuel
• Yao Steven
• Ferri Christopher
• Barr Brian
• Davis Michael
• Turner Taylor
• Reinert Owen
• Bergman Doron
• Schneider James

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1483 Primary

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title