Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital

Key finding

Susceptibility and intervention effectiveness varied sharply by staff group, and risk from a few phishing emails lingered about three days. Technical measures (filtering, in-email warnings) worked best, generic [EXTERNAL] tags did little, and some staff reacted to the simulation with fear, shame, guilt, and hostility.

Why it matters

Documents the emotional cost of simulations (shame, hostility) and that role and context shape susceptibility, both central to non-punitive design.

Informs

• Reports their own mistakes quickly supports
• Does not shame, punish, or publicly name people who click supports
• Pairs technical controls with human reporting supports

Cite

Tolsdorf, J., Langer, D., & Iacono, L. L. (2025). Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25). https://doi.org/10.1145/3719027.3765164