A framework for exploring incentive methods towards reducing phishing susceptibility in Healthcare: Based on a review and In-the-wild-field study approach

Abstract

Phishing remains a significant and ever-growing threat in our digitalized society. Its impact on industries crucial to human welfare, such as healthcare, can be devastating and even life-threatening. This paper presents a comprehensive exploration of various types of simulated phishing exercises in the healthcare sector, encompassing incentive methods, tools, risks, and ethical considerations through a scoping review.In this study, a total of six phishing simulation studies and sixteen simulated phishing tools were identified. Among the three types of simulated phishing studies (survey, lab-based experiment, in-the-wild study), a combination of survey and in-the-wild-field study, or a hybrid approach, has been commonly employed for conducting phishing simulations in healthcare settings. While the protection motivation theory has been examined to enhance phishing practices, no measures of incentives have been evaluated to improve resistance against phishing attacks.Regarding risk and ethics, the contentious issue of deception in research has sparked considerable debate across various communities. Nevertheless, employing the "to deceive" approach in in-the-wild-field studies has proven to be the most effective and efficient. However, it is imperative to adopt appropriate ethical measures to mitigate the risks associated with deceitfulness in such studies.Based on the findings of this review, a framework has been developed to guide future studies focusing on effective incentive-related approaches to reduce susceptibility among healthcare workers. This framework serves as a valuable resource for researchers and practitioners aiming to address the ongoing threat of phishing in the healthcare industry.