Patent Document ID: 8719940
Application ID: 13785252
Patent Flag: 1

Claim One:
1. A method, comprising: receiving, at a first computer system, a notification that a message has been identified by one or more individuals as a possible phishing attack, the message having been received on a computing device of each of the one or more individuals; determining, by the first computer system, whether the message is a known simulated phishing attack; and if the message is a known simulated phishing attack, recording in a database that each of the one or more individuals has correctly identified the message as a possible phishing attack; otherwise, if the message is not a known simulated phishing attack, determining, by the first computer system, a trustworthiness level for each of the one or more individuals; and processing, by the first computer system, the message based on the trustworthiness level of each of the one or more individuals to classify or not classify the message as a real phishing attack, wherein for a first one of the one or more individuals, the trustworthiness level of the first individual is based on one or more of: a percentage of simulated phishing attacks that the first individual correctly identified as a possible phishing attack, a percentage of simulated phishing attacks that the first individual ignored, a percentage of simulated phishing attacks that the first individual fell victim to, a sophistication level of a simulated phishing attack received by the first individual, a type of simulated phishing attack received by the first individual, a number of simulated phishing attacks that the first individual correctly identified as a possible phishing attack, a number of simulated phishing attacks that the first individual ignored, and a number of simulated phishing attacks that the first individual fell victim to, a number of real phishing attacks that the first individual correctly identified as a possible phishing attack, a number of real phishing attacks that the first individual ignored, a number of real phishing attacks that the first individual fell victim to, a field of employment of the first individual, an educational degree of the first individual, a job position of the first individual, and an employment history of the first individual.