phishing-simulation-analysis

# Phishing Simulation Analysis ## Overview A phishing-simulation campaign is only as useful as the trend and pattern analysis built on top of its raw click data. A single campaign's click rate tells you almost nothing on its own; the trend across campaigns, and which specific users click repeatedly, are what actually drive training prioritization. This skill covers how to build that analysis across whatever simulation platform is connected, and how to optionally enrich it with real-world phishing-incident data when a technical security tool is also available — treating that enrichment as a bonus, never a requirement. ## Anti-triggers - **Building or sending a simulated campaign** — templates, landing pages, recipient tracking, and phish-prone percentage are the vendor's surface; use `knowbe4-phishing`. - **Real-world attack targeting rather than simulated tests** — Very Attacked People reports and attack-index scoring describe genuine inbound campaigns; use `proofpoint-people`. This skill reasons about controlled tests, and never merges the two into one click rate. ## Step Zero: Confirm What's Connected Call `conduit__search_tools` for phishing-simulation and click-data tools before assuming a specific vendor. KnowBe4 is the primary simulation platform in this marketplace. Proofpoint (`proofpoint__list_vap_users` and related tools) and Checkpoint Avanan (`avanan__list_threats` and related tools) both carry phishing-click or "Very Attacked Person" style signal ...