A method for providing targeted, real-time, training to a user at a time of failing a test provided by a simulated phishing attack, comprising classifying, by one or more processors, events associated with different types of user interactions with simulated phishing emails of simulated phishing campaigns into categories; mapping, by the one or more processors, each of the categories with a predetermined user group of a plurality of different user groups, such that each predetermined user group is associated with one or more corresponding predetermined events; receiving, by the one or more processors, an indication of a detection of an event in connection with the user; identifying, by the one or more processors and based on the event, the predetermined user group for which to add the user among the plurality of different user groups; and automatically adding, by the one or more processors, responsive to the indication, the user to the predetermined user group, said predetermined user group being for remediation training regarding phishing emails, the remediation training being mapped to the group; providing, by the one or more processors, the electronically tracked remediation training to the user of the predetermined user group; receiving, by the one or more processors, a second indication that the user completed the remediation training; tracking, by the one or more processors, the number of courses of electronically tracked remediation training the user has completed; and automatically adding, by the one or more processors, responsive to the second indication, the user to a user group corresponding to one or more courses of the number of courses the user has completed. classifying, by one or more processors, events associated with different types of user interactions with simulated phishing emails of simulated phishing campaigns into categories; mapping, by the one or more processors, each of the categories with a predetermined user group of a plurality of different user groups, such that each predetermined user group is associated with one or more corresponding predetermined events; receiving, by the one or more processors, an indication of a detection of an event in connection with the user; identifying, by the one or more processors and based on the event, the predetermined user group for which to add the user among the plurality of different user groups; and automatically adding, by the one or more processors, responsive to the indication, the user to the predetermined user group, said predetermined user group being for remediation training regarding phishing emails, the remediation training being mapped to the group; providing, by the one or more processors, the electronically tracked remediation training to the user of the predetermined user group; receiving, by the one or more processors, a second indication that the user completed the remediation training; tracking, by the one or more processors, the number of courses of electronically tracked remediation training the user has completed; and automatically adding, by the one or more processors, responsive to the second indication, the user to a user group corresponding to one or more courses of the number of courses the user has completed.