Nick Selby :donor: on Nostr: In my experience, at its very best, anti-phishing training serves only to maintain ...

In my experience, at its very best, anti-phishing training serves only to maintain the fiction that users -- not leadership decisions not to invest in an effective security fabric -- are the problem. The cynicism of this industry and its customers knows no bounds.

Now come Ho, Mirian, Luo, Tong, Lee, Liu, Longhurst, Dameff, Savage, and Voelker with an empirical study, "Understanding the Efficacy of Phishing Training in Practice," whose stark coclusions include this gem:

“The absolute difference in failure rates between trained and untrained users is extremely low across a variety of training content. Users who receive and complete more instances of anti-phishing training can have an increased likelihood of failing subsequent phishing simulations."

But wait! It also finds that, in addition to making everyone hate security more because they're frogmarched into taking yet another stupid CBT course, there is “[n]o clear benefit from annual security training," as it pertains to users falling for phishing email.

Oh, you should read the pdf.

https://www.computer.org/csdl/proceedings-article/sp/2025/223600a076/21B7RjYyG9q - HT melanie ensign (she/her) (npub1tw2…vs2v) for the link