Cognitive Dissonance-Based Priming Intervention: Randomized Encouragement With in-the-Wild Phishing Simulation Attack...

Area of Science:

• Cybersecurity
• Psychology
• Healthcare

Background:

• Phishing attacks exploit psychological vulnerabilities in healthcare, leading to high susceptibility despite training.
• Cognitive dissonance (CD) is a proposed mechanism to counter unsafe rationalizations during phishing attempts.
• Real-world effectiveness of CD interventions using objective behavioral outcomes remains largely unevaluated.

Purpose of the Study:

• To assess if a brief CD-based priming intervention reduces phishing susceptibility in healthcare staff.
• To explore if CD exposure influences security perceptions and self-reported practices.

Main Methods:

• A 2-stage randomized-encouragement experiment was conducted at a Norwegian hospital.
• Participants were assigned to control or CD-primed groups, followed by a real-world phishing simulation.
• Phishing susceptibility was objectively measured by link-click behavior.

Main Results:

• Observed phishing click rates were 65% (control), 44% (CD-primed), and 53% (neutral).
• A statistically significant association between group and click behavior was not detected (P=.22).
• Descriptive analysis suggested reduced clicks in the CD-primed group, but with imprecise estimates.

Conclusions:

• Pre-exposure CD priming showed a non-significant trend towards reduced phishing clicks in a hospital setting.
• Current evidence does not establish a reliable behavioral effect for CD interventions.
• Larger, longitudinal studies are required to validate CD prompts as cybersecurity complements.