Effectiveness of and user preferences for security awareness training methodologies

Area of Science:

• Cybersecurity
• Human-Computer Interaction
• Information Security Training

Background:

• Phishing remains a significant cyber-attack vector, with technical defenses alone proving insufficient.
• Effective user education is critical to mitigate phishing threats and enhance overall cybersecurity posture.
• Existing anti-phishing training methods require evaluation for efficacy in reducing user susceptibility.

Purpose of the Study:

• To evaluate the effectiveness of instructor-led classroom training in reducing participant phishing susceptibility.
• To compare a combined training approach (video, game, text) with and without classroom instruction.
• To determine if additional classroom training significantly improves phishing susceptibility reduction.

Main Methods:

• A 2x2 mixed factorial design was employed to assess participant phishing susceptibility.
• Participants received a multi-modal training package (video, game, text).
• The study compared outcomes with and without supplementary instructor-led classroom training.

Main Results:

• Incorporating classroom training showed an insignificant improvement in reducing phishing susceptibility.
• No significant difference in susceptibility reduction was observed between training groups.
• Participants expressed a preference for classroom training when a single method choice was required.

Conclusions:

• While users may prefer classroom-based anti-phishing training, its addition does not significantly enhance susceptibility reduction.
• Current multi-modal training approaches may be sufficient, and further research into optimal training delivery is warranted.
• Focusing solely on classroom training may not be the most effective strategy for improving user resilience against phishing attacks.