Jove
Visualize
Contact Us
JoVE
x logofacebook logolinkedin logoyoutube logo
ABOUT JoVE
OverviewLeadershipBlogJoVE Help Center
AUTHORS
Publishing ProcessEditorial BoardScope & PoliciesPeer ReviewFAQSubmit
LIBRARIANS
TestimonialsSubscriptionsAccessResourcesLibrary Advisory BoardFAQ
RESEARCH
JoVE JournalMethods CollectionsJoVE Encyclopedia of ExperimentsArchive
EDUCATION
JoVE CoreJoVE BusinessJoVE Science EducationJoVE Lab ManualFaculty Resource CenterFaculty Site
Terms & Conditions of Use
Privacy Policy
Policies

Related Experiment Videos

Setting Priorities in Behavioral Interventions: An Application to Reducing Phishing Risk.

Casey Inez Canfield1, Baruch Fischhoff1,2

  • 1Engineering & Public Policy, Carnegie Mellon University, Pittsburgh, PA, USA.

Risk Analysis : an Official Publication of the Society for Risk Analysis
|October 13, 2017
PubMed
Summary

Related Concept Videos

You might also read

Related Articles

Articles linked to this work by shared authors, journal, and citation graph.

Sort by
Same author

Applied behavioral and decision sciences in support of US FDA's drug regulatory mission.

Proceedings of the National Academy of Sciences of the United States of America·2026
Same author

Science in service: Behavioral research applications across federal agencies.

Proceedings of the National Academy of Sciences of the United States of America·2026
Same author

Using Serious Games to Increase the Implementation of Trauma Triage Guidelines: A Randomized Clinical Trial.

JAMA·2026
Same author

Five tensions of artificial intelligence adoption for organ allocation: Applying the technology-organization-environment framework.

Digital health·2026
Same author

Clinicians' Approaches to Prognostication After Traumatic Brain Injury and Cardiac Arrest: A Multi-Hospital, Qualitative Study.

Neurocritical care·2026
Same author

Correction: Cross-sectional validation of the PROMIS-Preference scoring system.

PloS one·2025

Targeting vulnerable users in phishing attacks offers significant benefits. Interventions reducing their tendency to respond (response bias) are more cost-effective than those improving their detection skills (sensitivity).

Area of Science:

  • Cybersecurity
  • Human-Computer Interaction
  • Behavioral Economics

Background:

  • Phishing poses a significant and growing risk to organizations and individuals.
  • User vulnerability to phishing attacks varies considerably, necessitating targeted interventions.
  • Understanding user-specific risks is crucial for effective cybersecurity strategies.

Purpose of the Study:

  • To develop and demonstrate an approach for assessing the benefits and costs of interventions targeting users vulnerable to phishing.
  • To quantify the proportion of system-level phishing risk attributable to the most vulnerable user groups.
  • To estimate the monetary value and cost-effectiveness of behavioral interventions based on user vulnerability levels.

Main Methods:

  • Utilized Monte Carlo simulation to model user vulnerability and intervention outcomes.
Keywords:
Behavioral interventionbenefit-cost analysisphishingsignal detection theorysystem-level risk

Related Experiment Videos

  • Applied signal detection theory to characterize user vulnerability (response bias, sensitivity).
  • Analyzed phishing risk for both random and spear phishing attack scenarios.

    • Main Results:

    • Highly vulnerable users exhibited lower caution and reduced ability to distinguish phishing from legitimate emails.
    • Vulnerable users accounted for a disproportionately large share of overall phishing risk.
    • Behavioral interventions targeting response bias demonstrated greater net monetary benefit compared to those targeting sensitivity.

    Conclusions:

    • Targeting the most vulnerable users with cybersecurity interventions yields substantial net benefits.
    • Interventions focused on reducing response bias are more cost-effective than those aimed at increasing sensitivity.
    • Measuring user performance is essential for guiding the allocation and effectiveness of cybersecurity interventions.