The Research · Behaviors

What people and organizations do

Each behavior is rated by the strength of the research behind it.

I · People

Code	Behavior	Evidence	Studies
PB-01	Reports suspicious messages	Strong	4
PB-02	Pauses when a message pushes them to act fast	Moderate	3
PB-03	Verifies unusual requests through a second channel	Moderate	3
PB-04	Acts on the sense that something is off	Moderate	3
PB-05	Reports their own mistakes quickly	Emerging	3
PB-06	Questions requests that lean on authority	Contested	4
PB-07	Confirms identity before helping	Emerging	2
PB-08	Discounts 'everyone else already did it' claims	Contested	2
PB-09	Keeps secure habits when tired or busy	Moderate	4
PB-10	Shares scam stories with coworkers	Emerging	2
PB-11	Raises security friction openly	Moderate	3
PB-12	Stays alert to personalized, well-written messages	Emerging	2

II · Organizations

Code	Behavior	Evidence	Studies
OB-01	Answers every report with fast, positive feedback	Contested	3
OB-02	Gives Simulation feedback to everyone, not only those who clicked	Moderate	3
OB-03	Does not shame, punish, or publicly name people who click	Contested	5
OB-04	Measures reporting first, clicks second	Moderate	3
OB-05	Rates Simulation difficulty before judging results	Strong	2
OB-06	Varies content and cadence to prevent tune-out	Moderate	2
OB-07	Reinforces awareness at least every four months	Moderate	2
OB-08	Designs security rules people can actually follow	Moderate	4
OB-09	Builds a culture where it's safe to admit mistakes	Emerging	3
OB-10	Makes reporting one click and staffs triage for surges	Moderate	2
OB-11	Builds confidence, not fear, in awareness messages	Moderate	4
OB-12	Treats people as partners in security	Emerging	4
OB-13	Pairs technical controls with human reporting	Strong	3

Strong: two or more field studies agree. Moderate: consistent mixed-method support. Emerging: early or indirect. Contested: credible studies disagree.