Pairs technical controls with human reporting

Invests in filtering and warnings first, and treats trained people as the layer that catches what gets through.

Technical measures and email warnings outperformed training in field studies. People are the best defense for what filters miss, not a substitute for filters.

How to observe it: Share of real phish caught by filters compared with caught by reports.

Supporting evidence

• Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital Tolsdorf et al., 2025
• Phishing in Organizations: Findings from a Large-Scale and Long-Term Study Lain et al., 2022

Context

• Understanding the Efficacy of Phishing Training in Practice Ho et al., 2025