19 ms·

For those interested in the summary N = 14,773 T = 15 months in a corporate environment. - 18-19 yo are most likely to fall for phishing - people who use a

For those interested in the summary N = 14,773 T = 15 months in a corporate environment. - 18-19 yo are most likely to fall for phishing - people who use a computer in only a specialized fashion such as a single specialized program are most likely to fall for phishing. - Gender doesn't have any relation to falling for phishing - Training someone after they fall victim to a phishing attack makes them MORE likely to fall for future attacks. - Warnings on emails are effective, longer warnings are less effective. Those were the big ones I got interesting study maybe it will help InfoSec at my company not send out test phishing emails every week.

nerdponx 5y ago
> - Training someone after they fall victim to a phishing attack makes them MORE likely to fall for future attacks. Causality alert! What if companies that have post-phishing training are more likely to hire people who are susceptible to repeat phishing?
- buscoquadnary 5y ago
  They kept it on one company so that wouldn't be a confounding factor.
tlb 5y ago
> - Training someone after they fall victim to a phishing attack makes them MORE likely to fall for future attacks. Fascinating. A fair number of training programs seem to have the opposite of the intended effect. DARE (saying no to drugs) is a famous example. To guess a mechanism: the training gives some specific examples of phishing, probably from a few years ago, which don't match current techniques. The phishers also know what's in popular training courses, so they avoid known trigger phrases. So people are less likely to recognize a novel scam than if they'd never seen any.