Simulation Tests in Anti-phishing Training

Phishing is a form of social engineering attack that targets and exploits human vulnerabilities using such tactics as reciprocation, social proof, authority, and scarcity for psychological and behavioral manipulation. Phishing has been a primary factor and starting point that leads to the majority of cyber-attacks. The volume of phishing attacks along with resulting financial losses has been fast growing. As human factor is the weakest link in phishing attacks, effective anti-phishing training of human users is a significant research topic and critical to the security of organizational and individual data and other digital assets. Behavioral research shows that simulations are an acceptable and effective way of education and training for cognitive behavioral therapy (CPT) and human awareness and response improvement. This research presents an adapted behavioral training framework that employs simulation tests to address psychological factors of phishing for phishing awareness and response improvement. This research also contributes empirical data and performance results on employee anti-phishing awareness and response training using simulated phishing tests from a case study of an organization