Lessons From a Real World Evaluation of Anti-Phishing Training

Prior laboratory studies have shown that PhishGuru, an embedded training system, is an effective way to teach users to identify phishing scams. PhishGuru users are sent simulated phishing attacks and trained after they fall for the attacks. This paper extends the PhishGuru methodology to train users about spear phishing and test it in a real world setting with employees of a Portuguese company. These results demonstrate that the findings of PhishGuru laboratory studies do indeed hold up in a real world deployment.