PsySecPsychological Security

Research / Studies

Studies

Peer-reviewed research and foundational works, each summarized in plain English and tagged to PsySec principles, tactics, and the belief chain.

Filters (2 active)
Clear filters

2 studies match your filters

Download these as CSV

ChallengesField experiment · 2026

Anti-Phishing Training (Still) Does Not Work: A Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale

Rozema & Davis — Proceedings of the ACM Web Conference 2026 (WWW '26)

Training interventions had no significant effect on click rates or reporting rates, with negligible effect sizes. Phish Scale difficulty did predict behavior (7% clicks on easy emails vs 15% on hard), and in 36-55% of campaigns reports arrived before clicks, though training did not improve this.

P3P2
ChallengesRandomized controlled trial · 2025

Understanding the Efficacy of Phishing Training in Practice

Ho et al. — 2025 IEEE Symposium on Security and Privacy (SP)

Recent completion of annual awareness training had no significant link to failing phishing simulations, and embedded training produced only tiny differences in failure rates. Most users spent minimal time on training pages, and for some content types more training was associated with higher later failure rates.

P3P2