Design and evaluation of a behaviorally adaptive, multi-channel phishing simulation and training platform

Phishing attacks have expanded beyond email to SMS and social media, yet most awareness-training platforms remain email-centric, provide no real-time behavioral measurement, and deliver generic feedback long after a simulated failure. This paper presents the design, implementation, and empirical evaluation of a Behaviorally Adaptive, Multi-Channel Phishing Simulation and Training Platform (PhishSim) built on Python Flask, React.js, and PostgreSQL. The system delivers browser-rendered phishing stimuli across email, SMS, and mock social-media channels with no third-party messaging dependencies, computes a Behavioral Risk Score (BRS) from click-through rate, normalized click latency, a channel vulnerability multiplier, and a failure-frequency modifier, and routes participants to channel-specific micro-training the moment a simulation is failed. A two-group, pre-test/post-test randomized controlled pilot study was conducted with 10 undergraduate volunteers at the Air Force Institute of Technology (AFIT), Kaduna, Nigeria, across three simulation cycles; because the pilot fell short of its planned 40-participant, adequately powered design, all findings reported here are preliminary and directional rather than confirmatory. Results show that the BRS engine computes mathematically accurate and well-differentiated risk scores (range 0–68 in Cycle 1) and that the adaptive-training router correctly triggers channel-specific interventions. A paired-samples analysis of the available longitudinal data (n = 5 participants who completed more than one cycle) found no statistically significant change in BRS (t(4) = −0.59, p = 0.587; Wilcoxon W = 1.0, p = 1.00; Cohen's d = −0.26), which is consistent with a pilot too small and too incomplete to detect an effect rather than with an absence of one. This work extends the multi-channel simulation framework of Alsaqer et al. [12], which was validated only on simulated data, through a real-user evaluation, and it contributes two mechanisms absent from the baseline model: a failure-frequency escalation modifier and a channel-vulnerability offset term, together with an explicit weight-sensitivity analysis of the scoring formula.