Utilising Generative AI To Improve Practical Spear Phishing Training

Despite current anti-phishing measures, businesses still fall for phishing attacks, this issue stems from modern phishing attacks leveraging artificial intelligence. To address this issue, this research proposes the use of an automated pipeline to generate spear phishing emails for use by internal security professionals in practical spear phishing exercises. The proposed pipeline is automated, capable of using real employee data, is fully customisable with modular components, accepts any input data with fine-tuneable outputs, and is portable, as it can be accessed through the web. The pipeline was well received by businesses with generally positive feedback on the effectiveness of the pipeline and potential use cases. The generated emails were of good quality and of 60 responses, on average, the participants rated the emails a score of $4.11 / 5$ or “Very Accurate” and “Likely” to interact with the content of the emails, with an average score of $3.02 / 5$. The pipeline took an average of $\mathbf{1 7. 5}$ seconds per email. Using this number, it would take a business of 100 employees 29.17 minutes or a larger business with 1000 employees 4.86 hours. This level of speed and effectiveness showed that the pipeline could serve as an effective training tool for businesses.