How Right-hand.ai automated personalized security training and simulations
Security training content had to be tailored per employee, and the team could not produce and deliver it at that granularity by hand.
Devntech’s scope: Devntech’s contribution covered content-generation services, phishing-simulation workflows, background jobs, email templates and delivery, the product interface, hosting and ongoing engineering. This case makes no claim about reductions in security incidents because no approved before-and-after baseline is available.
The engagement
What Devntech built for Right-hand.ai
Right-hand.ai needed to turn employee-specific signals into security training, simulated phishing messages and follow-up activity without requiring a person to assemble every campaign. Devntech built the application services and delivery workflow that connect personalized content, background processing, email and interaction data inside one operating system.
What we changed
- 1
Built the services that generate personalized training content per user instead of one course for everyone.
- 2
Automated simulated phishing campaigns and the tracking of what each employee did with them.
- 3
Moved delivery onto a managed email pipeline with templates, so campaign sends stopped being a manual, error-prone job.
Qualitative evidence
What changed operationally
- Content is produced per employee rather than assembled by hand for each cohort.
- Campaign sends and follow-ups run as background work instead of blocking a person.
- The behaviour data comes back automatically and feeds the next round of training.
Evidence standard: These are delivered workflow and operating-state changes supported by the project record. They are qualitative results, not estimated percentages or modelled savings.
What Devntech continued to own
- Content generation services
- Background job infrastructure
- Email delivery
- Ongoing fixes
This is what we mean by
Demo to productionOperational flow
How the system works
The system is organized around three operational steps, with each handoff tied to a clear purpose and owner.
Step 1
Prepare training for the employee
Application services assemble content for an individual user instead of assigning one undifferentiated course to an entire cohort.
Step 2
Run the simulation in the background
Queued work prepares and sends simulated phishing messages without making an operator drive each delivery.
Step 3
Return behaviour to the programme
Interaction records flow back into the platform so administrators can review activity and inform later training.
What changed in practice
Capabilities built around the real workflow
Specific system capabilities, described by the operational job they do.
- Personalized content services
- Generate and deliver training material at the individual-user level through reusable application interfaces.
- Phishing simulation workflow
- Coordinates message preparation, delivery and interaction tracking as one repeatable process.
- Managed email delivery
- Uses controlled templates and a delivery provider rather than one-off operator sends.
- Reviewable behaviour data
- Returns campaign activity to the product so the security team can see what happened.
Implementation detail
What made this system difficult - and how we handled it
The decisions below came from the operating constraints of this engagement, not from a generic technology template.
Personalization changed the unit of work from a cohort to a person
Traditional awareness programmes can assign the same material to everyone. Right-hand.ai’s product required a finer operating model: content prepared for an individual employee, delivered through the appropriate campaign and connected to that employee’s later activity. Doing this manually would make greater relevance directly increase the administrative burden.
Devntech built reusable application services around personalized content. The service boundary allowed the product to request and present employee-specific training without embedding the generation process in every screen. The system could evolve the content workflow while preserving a consistent contract with the rest of the application.
Simulation delivery had to behave like a production workflow
A phishing simulation is not complete when a message is drafted. It has to be prepared from a controlled template, scheduled, sent reliably and associated with the right campaign and employee. Delivery may involve enough messages that it cannot safely run inside a user request or depend on an administrator keeping a browser open.
Background jobs separated campaign execution from the interface. Email templates and managed delivery made the message path repeatable, while campaign records kept the work tied to the platform. Operators could initiate and review simulations without manually coordinating each send.
The feedback path was as important as the send path
The purpose of a simulation is to observe behaviour that can inform training. Devntech connected message interactions back to the relevant user and campaign so the application could present what happened. This closed the loop between personalized material, a realistic exercise and the evidence available to programme administrators.
The resulting system changed the operating state without claiming an unsupported security outcome. Content could be prepared per employee, simulations could run as managed background work and behaviour could return to the programme automatically. Whether that reduces incidents requires a separate approved baseline and measurement period, so this case does not manufacture one.
Got a workflow like Right-hand.ai’s?
Describe the process. We come back with what it costs today, what could be automated and what we would build first.
- For established businesses from $5M in revenue, and products that are live, business-critical or already depended on
- No long-term commitment
- Start with one workflow or one system
- Keep ownership of everything we build