Proofpoint Security Awareness Training — PSAT, ThreatSim & VAP Risk Scoring

① What Proofpoint PSAT actually is — people-centric defence

Proofpoint Security Awareness Training (PSAT) sits at the intersection of simulation, education, and risk intelligence. While a traditional email gateway blocks known-bad messages, PSAT treats the human layer as both the biggest vulnerability and the most scalable control: train the person and every future attack targeting them gets a little harder to land.

The platform is built around three ideas. First, simulate reality: ThreatSim campaigns use real attack templates drawn from Proofpoint's global threat intelligence, so users see the same lures that hit their inbox in genuine campaigns. Second, measure risk per person: every interaction — click, report, missed training — feeds a Vulnerability Assessment score. Third, close the loop: CLEAR connects the report-phishing button all the way through to automated email quarantine.

PSAT integrates natively with Proofpoint's email security stack (TAP, TRAP, Email Protection) so that VAP data — the list of people most targeted by real attacks — flows in and shapes who gets simulated first and trained hardest.

② ThreatSim phishing simulations — real lures, measurable clicks

ThreatSim is the simulation engine inside PSAT. It ships with thousands of phishing, smishing (SMS), and USB-drop templates built from Proofpoint's live threat-intelligence feed, so the lures look and feel like the attacks employees actually face. Admins choose a template category (credential harvest, malware attachment, link-to-site, voice phishing, QR code), target a group, and schedule the send — ThreatSim handles delivery and tracking.

What happens when someone clicks

A click triggers just-in-time education: instead of a real payload, the user sees an immediate, branded coaching page that explains exactly what they missed and why the lure was dangerous. This moment — right when the mistake is fresh — is where behaviour change happens fastest. The platform can also auto-enrol the clicker into a relevant training module automatically, so no admin has to manually create a follow-up assignment.

ThreatSim also tracks near-misses: users who hovered over a link but did not click, or who reported the simulation. This gives a richer behaviour picture than a binary click / no-click metric alone.

③ Training modules & VAP risk scoring — adaptive, targeted, measurable

PSAT's content library holds a large portfolio of short, interactive training modules (average five to fifteen minutes each) covering phishing, social engineering, password hygiene, physical security, and more. Modules are mobile-responsive and on-demand, with embedded knowledge checks that provide immediate feedback rather than a single final quiz. Completion data feeds automatically into dashboards that show progress per user, per group, and org-wide.

The Vulnerability Assessment (VA) score is the risk number that matters most in reports. It combines simulation click rates, training completion, and engagement data into one per-person risk number. High scorers — especially those who are also VAPs (Very Attacked People) identified by Proofpoint TAP — get prioritised automatically for more frequent or more challenging simulations and targeted module assignments.

The People Risk Explorer dashboard surfaces the intersection of attack volume (from TAP) and susceptibility (from PSAT simulations) in one view, so security teams can focus their training budget where the combined risk is greatest rather than spreading it evenly across the org.

④ CLEAR & the closed loop — from report to auto-remediation

The closed loop starts with the PhishAlarm button — a one-click add-in for Outlook and Gmail that lets employees report suspected phishing directly from the inbox. Reported messages land in a triage queue, and CLEAR (Closed Loop Email Analysis and Response) connects that queue to TRAP (Threat Response Auto-Pull): if analysis confirms a message is malicious, TRAP automatically quarantines that message from every inbox across the organisation that received the same campaign — not just the reporter's copy.

Why the closed loop matters for culture

Without CLEAR, reporting feels thankless: users click 'report phishing', nothing visibly happens, and the habit fades. With CLEAR, reporters receive a confirmation message telling them whether their report was a real threat or a simulation. This feedback loop reinforces reporting behaviour — the metric that matters most for a resilient human firewall. Admins can benchmark their reporting rate and resilience factor (reports ÷ clicks) over time as KPIs for programme health.