Studies
3 studies · CSV
- Anti-Phishing Training (Still) Does Not Work: A Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale Rozema & Davis (2026). Proceedings of the ACM Web Conference 2026 (WWW '26) Training interventions had no significant effect on click rates or reporting rates, with negligible effect sizes. Phish Scale difficulty did predict behavior (7% clicks on easy emails vs 15% on hard), and in 36-55% of campaigns reports arrived before clicks, though training did not improve this.
- Understanding the Efficacy of Phishing Training in Practice Ho et al. (2025). 2025 IEEE Symposium on Security and Privacy (SP) Recent completion of annual awareness training had no significant link to failing phishing simulations, and embedded training produced only tiny differences in failure rates. Most users spent minimal time on training pages, and for some content types more training was associated with higher later failure rates.
- Going Spear Phishing: Exploring Embedded Training and Awareness Caputo et al. (2014). IEEE Security & Privacy Differently framed embedded training messages had no significant effect on whether people clicked later spear-phishing emails, and many people either clicked every link or none regardless of training. Employees largely did not read the training materials.