Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training

Key finding

Whatever benefit embedded training has comes from the nudge of being periodically reminded of the threat, not from the training content, which employees rarely read. Delaying training was as effective as immediate training, rewards did not improve behavior, and phishing looked like an attention problem rather than a knowledge problem.

Why it matters

Suggests frequent, light-touch reminders and attention cues matter more than content dumps or incentives, which bears on how feedback and habit loops are designed.

Informs

• Answers every report with fast, positive feedback challenges
• Varies content and cadence to prevent tune-out supports

Cite

Lain, D., Jost, T., Matetic, S., Kostiainen, K., & Capkun, S. (2024). Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training. Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24). https://doi.org/10.1145/3658644.3690348