AI-Powered Phishing Simulation for Security Training

This workflow automates realistic phishing simulations for internal security training. It pulls target lists from Google Sheets, leverages OpenAI's language model to craft personalized phishing emails, sends them through Gmail, and monitors interactions via a custom webhook that captures clicks on embedded tracking links. All results, including who clicked and when, are automatically logged back into Google Sheets for analysis and reporting.

Ideal for security teams, GRC professionals, and Red Teams, it enhances phishing awareness without external risks. Benefits include time savings on manual email creation, scalable simulations for large groups, and detailed metrics to measure training effectiveness. Customize prompts for industry-specific lures, swap email providers, or adjust tracking domains easily.

Requirements are straightforward: Google Sheets OAuth, OpenAI API key, Gmail credentials, and a self-hosted webhook endpoint (use ngrok for testing). Start manually or via Cron for scheduled campaigns. This modular setup supports compliance audits and iterative improvements in employee vigilance.