Security Awareness Training Simulator

Training Program

Campaign frequency 4 wk

Training strength 50%

Attacker sophistication 1.0x

Simulation speed 4 wk/s

Program Status

No campaign launched yet. Press Run or Launch Campaign Now.

Weeks elapsed

0.0

Campaigns run

Last click rate

—

Cumulative incidents

Low riskHigh risk

How it works

Each of the 180 employees carries a hidden baseline susceptibility s₀ drawn from a skewed distribution — most people are cautious, but a long tail is genuinely click-prone, matching real phishing-simulation industry data.

P(click) = clamp(s(t) × sophistication, 0, 0.97)
after a click: s(t) → s(t) × (1 − trainingStrength)
between campaigns: s(t) = s₀ − (s₀ − s_after)·e^(−Δt/τ),  τ ≈ 6 weeks

Campaign frequency — how often (in simulated weeks) the whole organization receives a simulated phishing test.
Training strength — how much a click-through's just-in-time training lesson cuts that employee's susceptibility, immediately.
Attacker sophistication — a multiplier on click probability; spear-phishing and pretexting push this above 1.0x, generic spam-style lures sit below it.
Forgetting curve — between campaigns, susceptibility relaxes exponentially back toward the employee's untrained baseline, mirroring the Ebbinghaus forgetting curve well documented in security-awareness research: training that isn't reinforced decays.

The dashboard reproduces the central finding from real corporate phishing-simulation programs: frequent campaigns with immediate feedback drive organization-wide click rates down over months, but spacing campaigns too far apart lets the benefit fade back toward baseline before the next test.

Trained / low risk High risk Clicked just now

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.