Facepalm: A new study of nearly 20,000 employees at UC San Diego Health raises questions about one of corporate America's most common defenses against cybercrime: mandatory phishing awareness training. Despite a broad push among companies and government agencies to educate workers on spotting online scams, the research suggests these programs may have little to no effect in preventing employees from falling for phishing attacks.
The eight-month study, conducted in 2023, involved 10 simulated phishing campaigns targeting staff across the California health system. Researchers sought to determine whether the standard annual training, widely used across industries, enhanced employees' ability to identify and avoid malicious emails. Instead of showing a gradual decline in attentiveness over time, as the researchers had expected, the results revealed no significant difference in failure rates, regardless of when workers last underwent training.
"That suggests the mandatory cyber awareness training did not provide beneficial security knowledge to users," Grant Ho, an assistant professor at the University of Chicago and a co-author of the study, told The Wall Street Journal.
The researchers found that employees who completed any form of training performed only marginally better than those who received none, with average failure rates reduced by just 1.7 percent. The consistency of failure rates, even immediately after training sessions, suggested that the programs had little impact on changing employee behavior.
Ho said there may be several reasons for the disappointing results. The material might be too generic, poorly designed, or presented in a format – typically a required online module – that employees are unlikely to absorb; many just tuned it out. Data showed that during simulated training sessions, employees spent less than a minute engaging with the material in more than three-quarters of cases. In 37 to 51 percent of sessions, employees closed the training page immediately. "A lot of times when employees click on a training module, one possible reason they leave immediately is because they are checking email or on the web for another purpose," Ho said.
To test whether different training styles were more effective, the study divided employees into multiple groups after each phishing simulation. Some were given general cybersecurity tips, while others received interactive Q&A modules, detailed briefings on the attack they had just encountered, or a combination of both. A separate control group of employees received no follow-up training.
The findings showed that interactive Q&A lessons provided the most measurable benefit, but only if staff members completed them. Although completion rates were low, employees who finished the interactive training were 19 percent less likely to fall for a phishing email. Still, because so few workers participated fully, the effectiveness of the program across the workforce remained negligible. Researchers noted that those who complete training may already be more conscientious, raising the possibility that personality traits, rather than the material itself, explain the difference.
Phishing remains one of the most common and damaging forms of cyberattack. Employees who click on fraudulent links or attachments can expose entire networks to intrusion. However, this study suggests that relying solely on human awareness training leaves organizations vulnerable.
Ho and his co-authors argue that companies should not abandon training altogether, but rather consider it one part of a broader defensive strategy. They suggest that automated tools capable of identifying and blocking suspicious messages before they reach inboxes are a more reliable safeguard.
"Training as it is commonly deployed," Ho said, "does not provide sufficient protection from phishing on its own."
Study shows mandatory cybersecurity courses do not stop phishing attacks
I never had a problem recognizing the test messages but I heard an older lady that had been with the company for 18 years was forced to retire because she kept clicking the links in the test messages!
