A widespread practice, surprising results
Every year, thousands of companies invest in phishing awareness programmes: simulated fraudulent emails, e-learning modules, security quizzes. The intent is good. But does it actually work?
A 15-month study by ETH Zurich researchers provides a surprising answer.
What the study tested
14,733 employees at a large company took part in a 15-month phishing simulation programme. Researchers tested several combinations: with or without training after a click, with or without a report button, with simple or detailed warnings.
The practice tested is the most common one in companies: simulate a fraudulent email, then redirect any employee who clicks to a training page. This is what dozens of awareness vendors sell.
The most common practice. But is it effective?
A counter-intuitive result
Employees who received training after clicking a simulated phishing link performed significantly worse over time than the control group.
The researchers' explanation: training creates a false sense of security. The employee believes the company has the problem under control, so they let their guard down.
The study included 25 in-depth interviews. The most troubling finding: employees who fell for simulations most often knew the signs of phishing perfectly well. Their problem is not a lack of knowledge. It's a lack of attention.
A knowledge problem
Employees don't know how to spot a fraudulent email.
An attention problem
Employees know the warning signs, but don't pay attention during their normal workflow.
“It was the sheer volume of emails that stopped me from looking closer. You click: next, next, next.”
What the researchers conclude
Technical interventions – automatic warnings and real-time detection – are more reliable than training in the long run, precisely because they don't depend on user vigilance.
Training remains useful as a short-term vigilance reminder. But it doesn't solve the structural problem: in a normal working environment, no one can maintain maximum vigilance on every email received.
Lain, D. (2024). ETH Zurich.
Short-term effect, counterproductive long-term according to the study
Useful reminder, but depends on human vigilance
Doesn't depend on human behaviour
What this means for your organisation
If training isn't enough, the only robust solution is to reduce reliance on human behaviour. That means making certain checks automatic, not optional.
This is the principle behind certifying sender identity: instead of asking the recipient to spot a fraudulent email, you certify that the email really comes from whom it claims to, regardless of the recipient's attention or vigilance.
Training approach
Relies on every recipient staying vigilant for every email received.
Certification approach
Proof of identity is shown automatically, with no action needed from the recipient.
Source: Lain, D. (2024). Improvements and Challenges of User-Centric Phishing Prevention. PhD thesis, ETH Zurich. Distinguished Paper Award, ACM CCS 2024.
One demo and you'll see the signature appear in Outlook.
Request a demo