A joke went around my LinkedIn feed recently. For the life of me I can’t find it now but it basically said:
Step one: employees spend hours on phishing training.
Step two: employees get a training certificate.
Step three: employees click an email from “Micro$oft Sales.”
It’s funny because it’s true. Or at least it feels true. I think everyone knows a version of that story, like the simulated email that went to the whole department, the “you’ve been phished!” landing page, the five-minute module you click through so you can get back to work. (In all honesty, this is an incredibly complicated topic and I make light because it’s the only way we can not lose our collective minds over it, and it’s only going to get worse.)
Still, I kept wondering whether anyone had actually measured it. Turns out someone did! Buckle up.
The Study
In 2022, Daniele Lain, Kari Kostiainen, and Srdjan Čapkun published a field experiment at the IEEE Symposium on Security and Privacy (one of the big security venues). It ran for 15 months inside a large company, with 14,733 employees picked at random from a workforce of more than 56,000. Each person got eight simulated phishing emails over that time, and the researchers randomly assigned people to different conditions. Some had a warning added to their simulated phishing emails, some got training when they failed, some got neither.
What I like about it is that these were real employees doing their real jobs (no lab, no students clicking through a mock inbox), with a control group for each intervention. That’s rare, and it’s expensive, and it’s the kind of study I wish we had a lot more of.
Findings
Warnings Helped
Employees whose simulated phishing emails carried a warning clicked less and did fewer dangerous things (submitting credentials, for example). A short warning worked about as well as a detailed one, which, honestly, is good news for anyone who has to write them. (One caveat the authors raise themselves: the warnings only ever appeared on the simulated phishing, never on legitimate mail, so we don’t know how they’d hold up once people get used to seeing them everywhere.)
Training Didn’t
People who failed a simulation were sent to a training page explaining what they’d missed. It’s a common “embedded training” setup and the authors point to vendors who sell it. The group that got it ended up with more clicks and more dangerous actions than the group that didn’t, and more of them failed repeatedly (801 repeat clickers in the trained group against 647 in the untrained one).
Yeah.
Reporting Worked
The company gave employees a button to report suspicious email, and people kept using it for the whole 15 months. Around 10% of reports on the simulated emails came in within five minutes. The reports weren’t perfect (about 68% accuracy on average), and that speed comes from the simulated emails rather than timed real attacks, but as a detection signal, a crowd of employees held up the entire time.
Careful, Now
A word of warning here, though. “Phishing training makes things worse” is a very shareable sentence. It’s also more than the study can actually back up.
The training they tested was voluntary. Nobody had to read the page, the study didn’t measure whether anyone did. Mandatory or enforced training wasn’t tested at all. So what I’m comfortable saying is that one common way of delivering training (a page you’re shown after you fail, which you can close) didn’t make people more resilient. It actually went along with more failures.
The page itself was built by a specialist provider following the usual best-practice guidance, so you can’t write it off as “well, they just had bad content.” My bet is that the open question is really engagement. That is, whether anyone read it and what would have made them.
Why would this page make things worse? The authors offer one possible explanation from a follow-up questionnaire. Some people said the training page made them feel safe or that it showed the company was protecting them. That’s interesting, but it comes from a small, self-selected group of respondents, and the authors treat it as an open question. I’m inclined to agree.
A Teaching Problem
This one struck a chord with me because I recognize the training they tested. It’s training as an event. It’s a page that appears after you slip, you sheepishly acknowledge it, and you go back to work without having practiced anything or heard what you’d do differently next time. We know from basically every other corner of education that this isn’t how people learn to do something differently. Not sure why we’d expect phishing to be the exception.
The reporting result is the part I keep coming back to, though. Reporting gave people a role. The authors describe employees as a kind of collective detection sensor, part of how the organization notices an attack, and I think that’s a much better picture than the usual “weakest link.”1 It’s also one I’d like to see cyber education spend a lot more time on.
So the joke has a point, at least about one kind of training (the click-through page you get after a failure). And the people we keep trying to “fix” might be more useful as part of the defense.
References
Footnotes
The weakest-link story is what Klimburg-Witjes and Wentland call the “deficient user”: a picture of people as “lacking, deficient, or ignorant” that social engineering talks and training keep rebuilding, and that looks a lot like the old deficit model of public understanding of science (Klimburg-Witjes & Wentland, 2021, p. 1320). Zimmermann and Renaud make the companion case from safety science, that people can be part of the solution and not only a problem to exclude, train, and constrain (Zimmermann & Renaud, 2019).↩︎
Reuse
Citation
@misc{straight2026,
author = {Straight, Ryan},
title = {The {Phishing} {Training} {Page} {That} {Made} {Things}
{Worse}},
date = {2026-11-11},
url = {https://ryanstraight.com/posts/2026-11-11-phishing-training/},
langid = {en}
}