Before
Security teams likely had to design realistic phishing and CEO fraud scenarios, find suitable malicious URLs or files, prepare email content and signatures, and assemble each test message manually. They also had to repeat the sending process whenever gateway rules needed to be retested, creating dependencies on individual expertise and manual preparation.
How it works
- A scheduled run initializes the target mailbox and configured URL or attachment test paths.
- The workflow selects a phishing or CEO fraud scenario, retrieves current malicious test artifacts when required, and generates the corresponding email content.
- It assembles the raw message and sends it to the target mailbox for email gateway handling and subsequent security review.
Workflow details
- Scheduled initiation: A scheduler starts each test run and applies the configured target email address and attack-vector settings, including URL and attachment testing.
- Threat material selection: The workflow randomly selects an email scenario and file type, then retrieves a recent malicious URL and, when enabled, a recent malware sample for use in the simulation.
- Scenario generation: For provider-themed phishing scenarios, an AI step drafts an HTML email imitating recognizable business notifications. For CEO fraud scenarios, it creates a business-themed request and adds an HTML signature profile.
- Email assembly: The workflow composes the subject and attachment name, combines the generated body with URL and attachment content when applicable, and prepares the complete raw email message.
- Gateway test delivery: The assembled message is sent from the configured sender identity to the target mailbox, creating a repeatable test case for reviewing controls such as sender validation, URL inspection, attachment analysis, and related email security rules.
What changed
Each scheduled run now produces and delivers a complete gateway test email without requiring a person to coordinate scenario creation, threat-artifact collection, message assembly, and delivery. Human review remains focused on examining how the email gateway handled the simulated message and whether the relevant security rules performed as expected.
Work removed
Creating phishing and CEO fraud email scenarios, selecting recent malicious URLs and malware samples, generating subjects and signatures, preparing attachment and message content, assembling raw email structures, and manually sending each recurring gateway test.
Expected outcome
One repeatable email gateway security simulation can be delivered per scheduled run, removing the recurring preparation and sending sequence while expanding coverage across phishing, CEO fraud, URL, and attachment scenarios.
