Studies
9 studies · CSV
- Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training Yin et al. (2026). MIS Quarterly Embedded feedback shown only to people who fail has limited reach and weaker field effects than lab studies suggested. Sending delayed feedback to all employees after a simulation (non-embedded training) emerged as a more promising way to reduce vulnerability over time.
- Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital Tolsdorf et al. (2025). Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS '25) Susceptibility and intervention effectiveness varied sharply by staff group, and risk from a few phishing emails lingered about three days. Technical measures (filtering, in-email warnings) worked best, generic [EXTERNAL] tags did little, and some staff reacted to the simulation with fear, shame, guilt, and hostility.
- Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training Lain et al. (2024). Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24) Whatever benefit embedded training has comes from the nudge of being periodically reminded of the threat, not from the training content, which employees rarely read. Delaying training was as effective as immediate training, rewards did not improve behavior, and phishing looked like an attention problem rather than a knowledge problem.
- Phishing in Organizations: Findings from a Large-Scale and Long-Term Study Lain et al. (2022). 2022 IEEE Symposium on Security and Privacy (SP) Embedded training shown after failing a simulation did not make employees more resilient and could even increase susceptibility, while email warnings helped. Employees reporting suspicious emails worked as a fast, sustainable crowd-sourced detection system, with reporters staying active over long periods.
- Cognitive Triaging of Phishing Attacks Heijden & Allodi (2019). 28th USENIX Security Symposium (USENIX Security 19), pp. 1309-1326 Measuring Cialdini-style persuasion triggers in real reported phishing let the authors predict which attacks would draw the most clicks, enabling response teams to prioritize takedowns. Consistency and scarcity triggers were associated with more clicks, reciprocity appeared counterproductive, and authority, social proof and liking showed no clear trend.
- Cyber security fear appeals: unexpectedly complicated Renaud & Dupuis (2019). Proceedings of the New Security Paradigms Workshop (NSPW '19) A review of the wider fear-appeal literature finds real disagreement over whether fear appeals are helpful or advisable, and wide variation in how cyber security fear-appeal experiments are designed. The authors propose a standard protocol for such studies.
- Susceptibility to Spear-Phishing Emails: Effects of Internet User Demographics and Email Content Lin et al. (2019). ACM Transactions on Computer-Human Interaction (TOCHI) 43% of participants clicked at least one simulated phishing email, with older women most susceptible. Young users' susceptibility dropped over the 21 days while older users' stayed flat, and the effectiveness of each persuasion technique and life-domain topic varied by age group. Older users also rated their own susceptibility lower than it was.
- Teaching Johnny not to fall for phish Kumaraguru et al. (2010). ACM Transactions on Internet Technology Embedded email-based training (PhishGuru) and a game (Anti-Phishing Phil) built on learning-science principles improved users' ability to recognize phishing. The authors frame user education as a complement to automated detection, noting that users are unmotivated and that training can raise false alarms on legitimate messages.
- Protection motivation and deterrence: a framework for security policy compliance in organisations Herath & Rao (2009). European Journal of Information Systems, 18(2) Threat severity, response efficacy, self-efficacy and response costs shaped attitudes to security policy. Organisational commitment and social influence significantly drove compliance intentions, and available resources boosted self-efficacy. Employees underestimated how likely breaches were.