A review of organization-oriented phishing research

Area of Science:

• Cybersecurity
• Information Security
• Computer Science

Background:

• Phishing attacks on organizations are increasing in sophistication and frequency.
• Existing cybersecurity strategies often focus on detection and user awareness.
• A gap exists in addressing other critical protection layers for organizational security.

Purpose of the Study:

• To systematically review and categorize organization-oriented phishing research.
• To identify current research trends and future research opportunities in organizational phishing.
• To analyze the scope of current research in phishing defense strategies.

Main Methods:

• Conducted a systematic review of 163 research articles on organizational phishing.
• Analyzed research to categorize existing studies and identify research gaps.
• Evaluated the focus areas within the current body of phishing research.

Main Results:

• A significant portion of research concentrates on phishing detection and user awareness testing.
• Crucial aspects of phishing defense, such as mitigation strategies, are underrepresented in the literature.
• Identified shortcomings and challenges in current organizational phishing research.

Conclusions:

• Current research predominantly addresses phishing detection and awareness, leaving mitigation under-explored.
• There is a need for more research into comprehensive phishing defense, including mitigation.
• This review provides a foundation for future research directions in organizational cybersecurity against phishing.