AI and technology · 1 min read
Fewer employees opened the fake link after information or practice
At a Dutch ministry, about one-third visited the test link without intervention. Informed or trained groups were 7 to 9 points lower.
The study, in plain language
A test email can show what employees do when an invitation looks legitimate but leads to a fraudulent page. At a Dutch ministry, different teams received phishing information, an earlier simulation with feedback, both, or neither.
Afterward, everyone received the same test email. Those who had received information or participated in the simulation visited the fake page less often and entered a password less often. The combined group also showed fewer risky responses.
Simulation alone came close to the combined result, so adding both interventions did not improve on practicing with the message.
The key idea
Information or simulation was associated with fewer visits to the fake page and fewer password entries. Combining the two showed no added improvement in visits.
Something to think about
A convincing email plays on urgency. If you receive an unexpected invitation, what detail would make you pause before opening the link?
The original study
Informing, simulating experience, or both: A field experiment on phishing risks
Source under CC BY 4.0. English adaptation and explanation by PaperFlow, with AI assistance. The text has been reorganized for a general audience; it is not the complete paper and does not imply endorsement by its authors.
One study alone does not represent a field's consensus. Educational content does not replace professional advice. Report a possible error.