Systems and methods are described for selecting a model for a simulated phishing campaign for a user based on classifying a user into a cluster of a plurality of clusters. A campaign controller may initiate a simulated phishing campaign for a user. In some examples, while initiating the simulated phishing campaign the campaign controller identifies a plurality of attributes of the user and/or a plurality of attributes of a company of the user, and sends the plurality of attributes to a serving module of the campaign controller. The serving module receives historical information on activity associated with the user during previous simulated phishing campaigns. The serving module uses the historical information as input into one or more clustering models and using the model, classifies the user into a cluster which contains users that are responsive to one or more specific models.