The administrative portal can aggregate information concerning individual user past performance with simulated phishing emails. The aggregated information can include statistics, such as non-limiting examples, the percentage of simulated phishing emails with which the user has interacted by clicking on a link, opening an attachment, or entering credentials. The aggregated information could include other types of data indicating a user having interacted with a simulated phishing email in a way that suggests the user has failed to distinguish the email as suspicious.
If an individual user has failed to distinguish a relatively high percentage of simulated phishing emails, then that user may be automatically entered into a queue to receive a relatively easier simulated phishing email at a future time, when the user is active in the user inbox, as detected using the systems described herein. Conversely, if a user has interacted with a relatively low percentage of simulated phishing emails by successfully distinguishing them or reporting them using a reporting tool button, then that user may be automatically entered into a queue to receive a relatively harder simulated phishing email at a future time, when the user is active in the user inbox, as detected using the systems described herein. The relative difficulty of a simulated email may be one that has relatively more or less apparent or obvious indicators of phishing, such as different domain names, misspellings, or unusual requests for information such as credentials.