Supports · 2020

An investigation of phishing awareness and education over time: When and how to best remind users

Benjamin Reinheimer, Lukas Aldag, Peter Mayer, Mattia Mossano, Reyhan Duezguen, Bettina Lofthouse, Tatiana von Landesberger, Melanie Volkamer

Key finding

After an awareness program, employees identified phishing and legitimate emails significantly better right away and at four months, but the gain was gone by six months. Reminders based on videos and interactive examples worked best and lasted at least another six months.

Why it matters

Shows awareness decays without reinforcement, supporting spaced, recurring touchpoints to build durable habits.

Informs

Reinforces awareness at least every four months supports

Cite

Reinheimer, B., Aldag, L., Mayer, P., Mossano, M., Duezguen, R., Lofthouse, B., Landesberger, T. v., & Volkamer, M. (2020). An investigation of phishing awareness and education over time: When and how to best remind users. Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020). https://www.usenix.org/conference/soups2020/presentation/reinheimer