Additionally, when users identify a suspicious message, it would be advantageous to rapidly remove that message from all other user accounts that have received that same or a similar suspicious message, and to rapidly restore that message if the message is subsequently determined to be benign.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1. illustrates an example logical flow for a system for receiving suspicious message reports, processing those messages, and generating simulated phishing messages based on those reports.
FIG. 2. illustrates an example architecture for a system for receiving suspicious message reports and identifying and quarantining similar messages.
FIG. 3 illustrates an example architecture for ingesting, storing and searching messages.
FIG. 4 illustrates an example multi-modal system for active response simulated phishing message delivery.
FIG. 5 illustrates an example architecture for injecting simulated phishing messages directly into user email accounts.
FIG. 6 illustrates an example high-level overview of a system for message delivery directly into user email accounts.
FIG. 7 illustrates an example process for filtering user account events to determine when a user is active in an email account.
FIG. 8 illustrates an example message flow for active response simulated phishing message delivery.
