Notifications
Clear all
Topic starter
14/07/2026 4:23 pm
TL;DR: Phishing simulations are often delayed by manual handoffs between SOC and awareness teams, even though attackers rapidly adapt lures to role, context, and business process, according to Proofpoint. The real governance issue is not content generation speed but whether detection and training can be operationally linked before the next wave lands.
NHIMG editorial — based on content published by Proofpoint: AI ThreatFlip workflow and phishing simulation automation
Questions worth separating out
Q: How should security teams turn phishing detections into effective training quickly?
A: Security teams should build a shared workflow between SOC and awareness teams so a detected lure can be sanitised, approved, and reused without manual rebuilding.
Q: Why do phishing simulations often fail to change behaviour?
A: They fail when they are generic, delayed, or disconnected from the attacks employees are actually seeing.
Q: What breaks when phishing intelligence stays trapped in the SOC?
A: The response loop breaks.
Practitioner guidance
- Measure detection-to-training latency Track the elapsed time from phishing detection to simulation deployment, then set an operational target for same-day conversion when the lure is still active in the environment.
- Sanitise every reused phishing message Remove malicious payloads, external links, and all personally identifiable information before a message is repurposed for awareness training.
- Map simulations to role-specific lures Build scenarios for HR, finance, help desk, and IT staff using the hooks those roles actually face, such as urgency, credential reset requests, and internal process cues.
What's in the full article
Proofpoint's full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step workflow mechanics for converting a detected phishing email into a safe simulation template
- Details on how phish hooks are identified and surfaced inside the simulation workflow
- Examples of how different teams can use the unified platform to shorten handoffs and improve response
- Governance and quality checks applied to AI-generated training content before reuse
👉 Read Proofpoint's analysis of AI ThreatFlip and phishing simulation workflow automation →
Phishing simulation workflows: what it means for SOC and awareness teams?
Explore further
14/07/2026 4:32 pm
Phishing response fails when detection and education sit in separate workflows. The article points to a common governance gap: organisations can detect a lure, yet still need days of manual work to turn that intelligence into training. That delay reduces the operational value of SOC findings and weakens the feedback loop between threat detection and user readiness. The real issue is workflow fragmentation, not a lack of awareness content.
A question worth separating out:
Q: Who should own the workflow from phishing detection to simulation?
A: Ownership should be shared across SOC, security awareness, and governance teams, with clear approval boundaries for reuse and sanitisation. SOC should identify and document the threat, awareness should shape the simulation, and governance should ensure privacy, logging, and policy adherence. No single team should act as the informal bridge.
👉 Read our full editorial: Phishing simulation workflows expose the gap between detection and readiness
