PB-01Strong evidence
Reports suspicious messages
Uses the reporting button or channel whenever a message feels wrong, whether or not they clicked.
Research / Behaviors
Behaviors
The specific things people and organizations do that PsySec says reduce manipulation risk. Each behavior links to the studies that support or challenge it.
What people do
Individual habits that help a person recognize, resist, and report manipulation. Codes start with PB.
PB-02Moderate evidence
Pauses when a message pushes them to act fast
Treats deadlines, threats, and 'act now' language as a signal to slow down, not speed up.
PB-03Moderate evidence
Verifies unusual requests through a second channel
Confirms payment changes, credential requests, and odd asks by calling or messaging the person through a known, separate channel.
PB-04Moderate evidence
Acts on the sense that something is off
Stops when a message feels wrong, even before they can say exactly why.
PB-05Emerging evidence
Reports their own mistakes quickly
Tells the security team right away after clicking a link, opening a file, or entering a password on a suspicious page.
BeliefBehavior
PB-06Contested evidence
Questions requests that lean on authority
Checks before acting when a message invokes a boss, executive, government body, or IT department.
PB-07Emerging evidence
Confirms identity before helping
Stays helpful, but confirms who is asking before sharing files, codes, or access.
PB-08Contested evidence
Discounts 'everyone else already did it' claims
Does not treat claims that coworkers already acted as a reason to act.
Social ProofBehavior
PB-09Moderate evidence
Keeps secure habits when tired or busy
Holds to a few key routines (report, verify, pause) even when overloaded.
Habit
PB-10Emerging evidence
Shares scam stories with coworkers
Tells teammates about attempted scams they spotted, in their own words.
BeliefEmotion
PB-11Moderate evidence
Raises security friction openly
Tells the security team when a rule blocks their work, instead of quietly building a workaround.
BeliefBehavior
PB-12Emerging evidence
Stays alert to personalized, well-written messages
No longer relies on typos and bad grammar as the main warning sign.
What organizations do
Program and culture choices that make those habits likely. Codes start with OB.
OB-01Contested evidence
Answers every report with fast, positive feedback
Thanks the reporter quickly and tells them whether the message was real, and why.
EmotionHabit
OB-02Moderate evidence
Gives Simulation feedback to everyone, not only those who clicked
Explains each Simulation to the whole audience afterward, instead of only showing a page to those who clicked.
BeliefBehavior
OB-03Contested evidence
Does not shame, punish, or publicly name people who click
Treats clicks as data about the Program, not as verdicts on people.
BeliefEmotion
OB-04Moderate evidence
Measures reporting first, clicks second
Uses reporting rate as the headline outcome and treats click rate as a diagnostic.
Behavior
OB-05Strong evidence
Rates Simulation difficulty before judging results
Scores each Simulation's difficulty (for example, with the NIST Phish Scale) and compares results only at similar difficulty.
Behavior
OB-06Moderate evidence
Varies content and cadence to prevent tune-out
Changes Simulation themes, formats, and timing so people keep paying attention.
Habit
OB-07Moderate evidence
Reinforces awareness at least every four months
Schedules reminders or short refreshers before awareness fades.
Habit
OB-08Moderate evidence
Designs security rules people can actually follow
Keeps the effort that policies demand within what people can sustain alongside their real work.
BeliefBehavior
OB-09Emerging evidence
Builds a culture where it's safe to admit mistakes
Leaders model admitting errors and respond to self-reports with help, not blame.
BeliefEmotion
OB-10Moderate evidence
Makes reporting one click and staffs triage for surges
Gives everyone a one-click report button and a triage process that can absorb a sudden flood of reports.
Behavior
OB-11Moderate evidence
Builds confidence, not fear, in awareness messages
Pairs every warning with a clear, doable action people believe they can take.
BeliefEmotion
OB-12Emerging evidence
Treats people as partners in security
Designs training that supports autonomy, competence, and belonging, and uses peers as messengers.
Belief
OB-13Strong evidence
Pairs technical controls with human reporting
Invests in filtering and warnings first, and treats trained people as the layer that catches what gets through.
Behavior
Evidence levels
| Level | Meaning |
|---|---|
| Strong | Two or more field studies or trials point the same way. |
| Moderate | Consistent support from a mix of field, lab, and survey research. |
| Emerging | Early or indirect support; more research needed. |
| Contested | Credible studies disagree. |
Ratings are editorial judgments explained in the methodology.