Efficacy of Embedded Phishing Training

Embedded phishing training is a training methodology where users are sent simulated phishing emails to test users’ vulnerability to phishing attacks. Research studies seeking to evaluate the effectiveness of embedded phishing training at educating end-users have conflicting results. In this study, a phishing campaign with embedded phishing exercises is conducted to determine the effectiveness of embedded phishing exercises. The phishing campaign involved 924 participants from a single financial institution and utilized 1,848 embedded phishing emails. The first part of this study focuses on previous studies that have attempted to measure the efficacy of embedded phishing training at educating end-users. Based on previous studies, a methodology is developed to measure efficacy of the embedded phishing training. The first and last round of the phishing campaign is utilized to perform an analysis of the effectiveness of the embedded phishing training. Based on the results of the phishing campaign, a hypothesis can be made that the embedded phishing training was effective at educating end-users and reduced participants susceptibility to phishing attacks. Suggestions are given to identify how the design of embedded phishing training can be improved