An adaptive phishing awareness training environment based on LLMs and interactive learning

Abstract

Phishing remains a major cybersecurity threat, exploiting human vulnerabilities through deceptive tactics. Traditional awareness training often involves simulated phishing campaigns via e-mail and similar channels, in addition to training materials for employees to complete. Prior work indicates limitations in effectiveness, highlighting the lack of interactivity and contextual factors. This paper explores an interactive, user-adaptive, LLM-based approach to phishing awareness training, combining simulated phishing campaigns with adaptive feedback mechanisms from interactive learning. A training environment was developed as a research prototype, supporting experiments on adaptive training methods, including modes of interaction, target customization, feedback, and adaptivity to user environments. The prototype demonstrates the potential of realizing these aspects with LLMs according to interactive learning principles, such as targeted user engagement and instantaneous feedback. It is intended to serve as a basis for studies on effectiveness, efficiency, and adaptive methods in corporate settings, education, or phishing prevention initiatives.