A threat management facility generates a simulated phishing threat based on one or more characteristics of users of an enterprise network and transmits the simulated phishing threat to the users of the enterprise network. Based on whether a user fails to respond appropriately to the simulated phishing threat, the threat management facility may adjust a profile of the user. Network traffic to and from an endpoint associated with the user may be processed according to the adjusted profile.