Anti-Phishing Training (Still) Does Not Work: A Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale

Key finding

Training interventions had no significant effect on click rates or reporting rates, with negligible effect sizes. Phish Scale difficulty did predict behavior (7% clicks on easy emails vs 15% on hard), and in 36-55% of campaigns reports arrived before clicks, though training did not improve this.

Why it matters

Independent reproduction that standard training does not change clicks or reporting, while showing that measuring difficulty and report-before-click timing is informative.

Informs

• Reports suspicious messages challenges
• Rates Simulation difficulty before judging results supports

Cite

Rozema, A. T., & Davis, J. C. (2026). Anti-Phishing Training (Still) Does Not Work: A Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale. Proceedings of the ACM Web Conference 2026 (WWW '26). https://doi.org/10.1145/3774904.3792467