n8n workflow · multi-vector generator + deterministic gate

Phishing Sim Production Line

Calibrated multi-vector phishing training, produced at volume.

status running · private n8nrole designed + built end to end
view code ↗
Phishing Sim Production Line: The workflow running on n8n. parse and gate materializes every tier and counts t
The workflow running on n8n. parse and gate materializes every tier and counts the planted flags; a wrong count never reaches a reviewer.
Phishing Sim Production Line: The reviewer surface for a generated sim, hardest tier: every planted flag highl
The reviewer surface for a generated sim, hardest tier: every planted flag highlighted and named, with the teaching text a trainee sees afterwards.
Phishing Sim Production Line: Execution 116, fired 10 August. One payroll brief in, and 66 seconds later three
Execution 116, fired 10 August. One payroll brief in, and 66 seconds later three message vectors and a landing page came out with every planted flag counted and named. Gate passed with no blocks, and the run parked at the reviewer gate.
interactive · click and scroll itlive
The reviewer surface: four tiers, every planted red flag highlighted and named, 0 / 2 / 4 / 6 by design.
3 vectorsemail, SMS, and WhatsApp built from one brief, plus a credential-capture landing page.
2 / 4 / 6planted flags per tier, counted in code. Advanced, Intermediate, Beginner. Original stays clean.
66 secbrief to gated output on the 10 August run, from a single webhook POST.
0 blocksthe gate found nothing wrong. When it does, the sim goes to a revision queue, not a reviewer.
What it solves

Training sims need exact calibration. An Advanced tier hides one or two tells, Beginner plants five or six, and every flag has to be a real named indicator or the training data is worthless. The design decision that made this reliable: the model returns one clean original plus a per-tier injection plan, and deterministic code materializes all tiers and counts the spans, so token limits and JSON escaping can never corrupt a tier.

Who it serves

Security-awareness teams and MSPs running phishing training across clients and languages.

Who it is for

The content engineer who used to hand-author every sim.

How it works
  1. Brief inA brand, a scenario, and a target tier spread arrive on the webhook.
  2. Claude writes the originalOne clean phishing email, plus a per-tier injection plan that says which tells to add where.
  3. Code materializes every tierA deterministic node builds the four email tiers, SMS, and WhatsApp, wrapping each planted flag in a named span.
  4. The gate counts flagsIt re-checks span counts against the platform rules: 0 / 2 / 4 / 6, correct indicator names only. Wrong count or a blocked indicator is rejected.
  5. Human approvesA reviewer sees a tabbed preview of every vector with flags highlighted, and approves or sends back.
  6. Package outApproved sims export as upload-ready HTML, a landing page, an indicators sheet, and per-vector ZIPs.
What I would change if I rebuilt it today

The injection-plan design, where the model plans and deterministic code materializes every tier, was the right call: it survived the token-limit and JSON-escape failures that killed the naive four-full-HTMLs version. Next I would add per-locale linguistic QA. The gate checks structure, not idiom, and idiom is where a sim gets clocked by the trainee.

Built with
n8n Claude (Sonnet) HTML sim builder span-count validator ZIP packager