Studies
3 studies · CSV
- Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training Yin et al. (2026). MIS Quarterly Embedded feedback shown only to people who fail has limited reach and weaker field effects than lab studies suggested. Sending delayed feedback to all employees after a simulation (non-embedded training) emerged as a more promising way to reduce vulnerability over time.
- Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training Lain et al. (2024). Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS '24) Whatever benefit embedded training has comes from the nudge of being periodically reminded of the threat, not from the training content, which employees rarely read. Delaying training was as effective as immediate training, rewards did not improve behavior, and phishing looked like an attention problem rather than a knowledge problem.
- Phishing in Organizations: Findings from a Large-Scale and Long-Term Study Lain et al. (2022). 2022 IEEE Symposium on Security and Privacy (SP) Embedded training shown after failing a simulation did not make employees more resilient and could even increase susceptibility, while email warnings helped. Employees reporting suspicious emails worked as a fast, sustainable crowd-sourced detection system, with reporters staying active over long periods.