Creating Phishing Emails with AI

GOAA · 20 questions

• A city security-awareness program needs an authorized phishing simulation platform for permitting staff. Which tool best fits a campaign that sends tracked emails and records clicks under ROE?
• A county purple team compares Social Engineering Toolkit (SET) modules with GoPhish for a controlled clerk-office drill. Which distinction best guides tool choice?
• A transit SOC uses generative AI to draft a believable badge-renewal phishing lure for an authorized drill. What step most improves quality while staying inside civic controls?
• A water-utility phishing exercise uses AI to draft templates for an authorized staff campaign. Which privacy constraint is most appropriate?
• A school-district phishing campaign uses GoPhish dashboards after an authorized send. How should leaders best use the resulting click-rate data?
• A housing-authority communicator asks generative AI to rewrite an authorized phishing lure into multiple languages for multilingual staff. Which condition keeps the approach in bounds?
• A municipal legal review covers a planned SET-based credential-harvest simulation against employees. Which control set is most appropriate before launch?
• A fusion-center awareness brief warns staff that AI-polished phishing can differ from classic typo-ridden lures. Which detection challenge should trainers emphasize?
• A city red team feeds materials into AI prompts while drafting authorized portal-lookalike phishing content. Which scoping rule best protects the municipality?
• A parks department GoPhish simulation needs a landing-page outcome that supports learning without endangering production identity. Which design is most appropriate?
• A public-health purple team prompt-engineers urgency cues such as ‘lab results ready’ for an authorized staff phishing drill. Which adjustment best balances realism and ethics?
• A county SOC distinguishes AI-written phishing email bodies from what GoPhish must still provide in an authorized campaign. Which statement is most accurate?
• A transit after-action finds that AI suggested risky CEO-fraud wording that violated the city’s exercise tone guidelines. What should the team do with such drafts?
• A court clerk drill plans to use SET for an authorized phishing-related simulation. Which deployment control is most appropriate?
• A city CISO runs a tabletop where staff examine AI-generated phishing that appears personalized from public professional bios. What should analysts recognize?
• A municipal campaign calendar schedules GoPhish sends for an authorized awareness program. Which timing practice is most responsible?
• A school IT team uses AI to suggest attachment filenames for an authorized phishing drill. Which constraint keeps the exercise non-destructive?
• A water-utility awareness lead compares static template-only phishing with AI-varied per-user lures for an authorized program. What evaluation focus is most appropriate?
• A housing SOC integrates GoPhish with existing staff phishing-report workflows. Which integration goal is most important?
• A county purple-team checklist sequences an authorized AI-assisted phishing exercise end to end. Which order best reflects sound municipal practice?