1. A method, comprising: conducting a simulated phishing attack on individuals from a first group; recording a response of each individual from the first group to the simulated phishing attack; calculating an aggregate performance of the first group based on the respective responses; and comparing the aggregate performance of the first group with an aggregate performance of individuals from a second group so as to determine whether an additional simulated phishing attack should be administered to the individuals from the first group, wherein the simulated phishing attack is standardized for all individuals from the first and second groups so as to allow the aggregate performance of the first group to be compared with the aggregate performance of the second group.