Psychological Security
Psychological Security (PsySec) is the discipline of defending people against manipulation. It builds the beliefs, instincts, and habits that help people recognize and report social engineering, inside a culture that treats them as partners, not risks.
Each era of security emerged when the one before it stopped being enough.
Guards, gates, and locks. Protects against threats you can see.
Firewalls, endpoint, identity. Protects against threats software can detect.
Beliefs, instincts, and habits. Protects against attacks on human judgment.
PsySec works the whole chain. Most programs try to force behavior directly and skip the first two links.
The database includes evidence for and against PsySec claims: 22 supporting, 10 mixed, 4 challenging, and 12 foundational works.
Embedded feedback shown only to people who fail has limited reach and weaker field effects than lab studies suggested. Sending delayed feedback to all employees after a simulation (non-embedded training) emerged as a more promising way to reduce vulnerability over time.
The main reason employees report suspicious emails is wanting to protect and help the organization and coworkers, followed by responsibility, awareness of consequences, and feelings of insecurity. Reporters were more likely to report convincing, well-impersonated emails, showing they judge potential impact.
Recent completion of annual awareness training had no significant link to failing phishing simulations, and embedded training produced only tiny differences in failure rates. Most users spent minimal time on training pages, and for some content types more training was associated with higher later failure rates.
Embedded training shown after failing a simulation did not make employees more resilient and could even increase susceptibility, while email warnings helped. Employees reporting suspicious emails worked as a fast, sustainable crowd-sourced detection system, with reporters staying active over long periods.
The PsySec Research Database is free to use and cite. It is maintained by Hook Security, which developed the PsySec approach; our methodology explains how studies are selected and how we avoid cherry-picking. Researchers can submit studies or corrections.