Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training

Key finding

Embedded feedback shown only to people who fail has limited reach and weaker field effects than lab studies suggested. Sending delayed feedback to all employees after a simulation (non-embedded training) emerged as a more promising way to reduce vulnerability over time.

Why it matters for PsySec

Supports giving everyone fast, non-judgmental post-simulation feedback rather than reserving feedback for those who 'failed'.

Stance: Mixed. Findings cut both ways. Summaries are written by the database editors; read the original for full results and limitations.

Tags

Behaviors this study informs

• supports
  OB-02 · Gives Simulation feedback to everyone, not only those who clicked

Cite this study

APA

Yin, D., Mullarkey, M., Vreede, G. d., & Limayem, M. (2026). Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training. MIS Quarterly. https://doi.org/10.25300/MISQ/2025/19354

BibTeX

@article{yin_2026_learning_by_phishing,
  title = {Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training},
  author = {Dezhi Yin and Matthew Mullarkey and Gert-Jan de Vreede and Moez Limayem},
  year = {2026},
  journal = {MIS Quarterly},
  doi = {10.25300/MISQ/2025/19354},
  url = {https://doi.org/10.25300/MISQ/2025/19354}
}