Training The Human Firewall

The talk opens with a problem: phishing remains a leading attack, and awareness programs often see click rates level off at a low point that can look like success. The speaker, drawing on her graduate research, argues that training works better when it starts from how employees think and act. She introduces the idea of user architecture, built from how users view threats and how their departments shape their daily email habits.

To test this, more than 100 participants with computer science and security backgrounds received three phishing campaigns of rising difficulty: a mass lure, a spear phishing message using scare and trust tactics, and a spoof with few obvious warning signs. The lures were sent through a free open-source phishing platform, and clicks were recorded. Many participants clicked the mass lure, the scare-based spear phish and the spoof, citing habits like clicking before analyzing, curiosity and reliance on antivirus. Click rates varied widely across the campaigns, which the speaker read as a sign of gaps in education rather than a finished program.

For practitioners, the talk recommends setting realistic click goals, since a rate near one to three percent may mean users have plateaued. Mixing in outlier threats, including spoofing and current real-world campaigns, keeps training challenging. Reporting data from service desks, the security operations center and blocked threats can guide exercise design. Recognizing users who report suspicious mail helps offset frustration with constant testing.