A computer-implemented method, comprising: generating (201, 705), by a machine learning model, a simulated attack message, the simulated attack message including a plurality of potentially malicious elements in different spatial regions, the simulated attack message being configured for annotation by users as part of cybersecurity training; sending (202, 710), via a communication interface, the simulated attack message to an enterprise user device (120, 130); causing the enterprise user device (120, 130) to prompt a user to identify one or more potentially malicious elements in the simulated attack message with one or more annotation tools; receiving, from the enterprise user device (120, 130), user selections annotating selected elements of the plurality of potentially malicious elements of the simulated attack message that the user indicates as being potentially malicious; identifying (209, 720) one or more training areas for a user based on the user selections received from the enterprise user device (120, 130); generating (210, 725) a customized training module specific to the identified one or more training areas; sending the customized training module to the enterprise user device (120, 130), wherein sending the customized training module to the enterprise user device (120, 130) causes the enterprise user device (120, 130) to display the customized training module; computing (215, 815) a frequency with which each element of the plurality of elements is correctly selected by users; and updating (233, 735) the machine learning model used in generating (201, 705) the simulated attack message based on the computed frequency with which each element of the plurality of elements is correctly selected by users. generating (201, 705), by a machine learning model, a simulated attack message, the simulated attack message including a plurality of potentially malicious elements in different spatial regions, the simulated attack message being configured for annotation by users as part of cybersecurity training; sending (202, 710), via a communication interface, the simulated attack message to an enterprise user device (120, 130); causing the enterprise user device (120, 130) to prompt a user to identify one or more potentially malicious elements in the simulated attack message with one or more annotation tools; receiving, from the enterprise user device (120, 130), user selections annotating selected elements of the plurality of potentially malicious elements of the simulated attack message that the user indicates as being potentially malicious; identifying (209, 720) one or more training areas for a user based on the user selections received from the enterprise user device (120, 130); generating (210, 725) a customized training module specific to the identified one or more training areas; sending the customized training module to the enterprise user device (120, 130), wherein sending the customized training module to the enterprise user device (120, 130) causes the enterprise user device (120, 130) to display the customized training module; computing (215, 815) a frequency with which each element of the plurality of elements is correctly selected by users; and updating (233, 735) the machine learning model used in generating (201, 705) the simulated attack message based on the computed frequency with which each element of the plurality of elements is correctly selected by users.