Anti-Phishing Training (Still) Does Not Work: A Large-Scale Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale
Andrew T. Rozema, James C. Davis
Stop budgeting for annual phishing training as your primary defense. Redirect resources to technical controls: email filtering, MFA enforcement, and privilege separation. If compliance mandates training, treat it as a checkbox, not a security strategy.
Organizations spend millions on mandatory phishing training, assuming it reduces click-through rates. Compliance requirements mandate it, but nobody measures whether employees actually get better at spotting attacks.
Method: A 12,511-person field study at a US fintech firm used the NIST Phish Scale to standardize phishing difficulty across test emails. Even after training, employees showed no significant improvement in detecting phishing attempts. The study controlled for email difficulty—something prior research ignored—and found training effects vanished when you account for varying attack sophistication. The NIST scale rates phishing emails from 0-5 based on cue detectability; trained employees performed identically to untrained ones across all difficulty levels.
Caveats: Single organization study in fintech. Results may not generalize to industries with different threat models or employee technical literacy.
Reflections: Do continuous micro-training interventions (e.g., real-time warnings) outperform annual training modules? · Can personalized training based on individual click patterns improve outcomes? · What's the cost-benefit ratio of training versus technical controls across different organization sizes?