A system for improving cybersecurity includes a server configured to define a group of users associated with corresponding user devices, send calibration vectors to user devices, receive actions performed calibration vectors by users, allocate users in the group to one of sub-groups based on received actions, send a set of simulated vectors to user devices associated with users allocated to a particular subgroup, receive actions performed on the simulated vectors by each of the users in the subgroups, define a threshold expertise level for the subgroups, receive, one or more threat vectors reported by one or more users allocated to the sub-groups having the expertise level above the threshold expertise level, update the set of simulated vectors based on the received threat vector, and use the updated set of simulated vectors as training vectors for the each of the users allocated to a particular subgroup to improve cybersecurity.