Cybersecurity Awareness Education: Just as Useful for Technical Users

Cybersecurity education is often perceived as necessary particularly for laypersons, as experts in the field are usually expected to be aware of the risks posed by human-centered attacks such as phishing. In a lab study with 48 participants from IT-related study programs, we studied their phishing investigation behavior using an eye tracker across three email classification sessions. Between the first two sessions, participants received additional training on detecting phishing attacks. The third session, one week later served to measure retention of performance. Exposure to the teaching material particularly showed to decrease investigation time required for the classification. Further, it helped participants focus on the important indicators inside the phishing emails.