1. A method comprising: (a) receiving, by server comprising one or more processors coupled to memory, a first indication of a first predetermined event associated with a simulated phishing email of a simulated phishing campaign communicated to a user of a first user group of a plurality of user groups; (b) including, by the server responsive to receiving the first indication, the user in a second user group that identifies users to receive training regarding phishing emails; (c) receiving, by the server, a second indication of a second predetermined event associated with the user's training regarding phishing emails; and (d) including, by the server responsive to the second indication, the user in one of the plurality of user groups.