Understanding the Efficacy of Phishing Training in Practice

Key finding

Recent completion of annual awareness training had no significant link to failing phishing simulations, and embedded training produced only tiny differences in failure rates. Most users spent minimal time on training pages, and for some content types more training was associated with higher later failure rates.

Why it matters for PsySec

The largest RCT to date showing conventional annual and embedded training barely moves behavior, a direct challenge any simulation-based program must answer.

Stance: Challenges. Evidence against, or limiting, a PsySec claim. Summaries are written by the database editors; read the original for full results and limitations.

Tags

Behaviors this study informs

• context
  OB-02 · Gives Simulation feedback to everyone, not only those who clicked
• context
  OB-13 · Pairs technical controls with human reporting

Cite this study

APA

Ho, G., Mirian, A., Luo, E., Tong, K., Lee, E., Liu, L., & et al. (2025). Understanding the Efficacy of Phishing Training in Practice. 2025 IEEE Symposium on Security and Privacy (SP). https://doi.org/10.1109/SP61157.2025.00076

BibTeX

@inproceedings{ho_2025_efficacy_of_phishing_training,
  title = {Understanding the Efficacy of Phishing Training in Practice},
  author = {Grant Ho and Ariana Mirian and Elisa Luo and Khang Tong and Euyhyun Lee and Lin Liu and et al.},
  year = {2025},
  booktitle = {2025 IEEE Symposium on Security and Privacy (SP)},
  doi = {10.1109/SP61157.2025.00076},
  url = {https://doi.org/10.1109/SP61157.2025.00076}
}