Human factors in phishing: Understanding susceptibility and resilience

Abstract

This study examines the demographic and organizational factors influencing phishing susceptibility and incident reporting behaviors among employees in a large European financial organization following realistic phishing simulations and how these factors correlate with susceptibility to phishing attacks. In the phishing simulations campaign with 8,102 participants, unannounced, monthly phishing emails with different templates are sent during regular work hours over a duration of 2 years, and the reactions (clicking the link and reporting the phishing email) are collected. The results are combined with demographic and relevant organizational data such as age, gender, level of education, department type, tenure, and job level. Multivariate logistic regression models are developed to analyze the relationship between these variables and phishing behaviors.

The analysis reveals significant differences in susceptibility to and resilience against phishing attacks across various demographic and organizational groups. Older employees are more susceptible to phishing, while males show lower vulnerability to phishing attacks. Additionally, our results revealed that higher-level employees often under report phishing emails. These findings highlight the necessity for targeted anti-phishing training tailored to different demographics and departments within the organization and the importance of fostering a culture of incident reporting. Recommendations include customized cyber awareness training programs, regular awareness sessions, and incentivizing reporting.

Future research is encouraged to prioritize investigating the root causes of phishing behaviors and evaluating the effectiveness of training programs.