Training

Dr. Arun Vishwanath, Ph.D., MBA., discusses his research on the effectiveness of cyber awareness training as a phishing defense. Dr. Vishwanath is an expert in human cognition. This is a must-watch video for anyone interested in training as a cyber defensive strategy.

Used with permission.

In the above video, Dr. Vishwanath discusses two training case studies. In one case study, a U.S. Government agency adopted embedded training. The agency measured the effectiveness of the training on a quarterly basis. After two years of embedded training, the percentage of users phished fell from 11.8% to 0.45%. When Dr. Vishwanath ran his own simulated phishing attack, he had a 14% phished rate.

After two years of embedded training, why did users do so poorly in Dr. Vishwanath’s study? Dr. Vishwanath found that rather than making users more resistant to real phishing attacks, the repeated simulated attacks in embedded training made users better at detecting simulated attacks. This is because, with repetition, the users were able to tell exactly which emails were phishing tests. However the training was not effective against real phishing emails.

Why does training fail to defend against phishing?  Because threat actors respond to training by drafting phishing emails that are not suspicious. SP Guard surfaces threat intelligence that aids users in unmasking phishing emails.