Phishing for Long Tails: Examining Organizational Repeat Clickers and Protective Stewards

Abstract

Organizational cybersecurity efforts depend largely on the employees who reside within organizational walls. These individuals are central to the effectiveness of organizational actions to protect sensitive assets, and research has shown that they can be detrimental (e.g., sabotage and computer abuse) as well as beneficial (e.g., protective motivated behaviors) to their organizations. One major context where employees affect their organizations is phishing via email systems, which is a common attack vector used by external actors to penetrate organizational networks, steal employee credentials, and create other forms of harm. In analyzing the behavior of more than 6,000 employees at a large university in the Southeast United States during 20 mock phishing campaigns over a 19-month period, this research effort makes several contributions. First, employees’ negative behaviors like clicking links and then entering data are evaluated alongside the positive behaviors of reporting the suspected phishing attempts to the proper organizational representatives. The analysis displays evidence of both repeat clicker and repeat reporter phenomena and their frequency and Pareto distributions across the study time frame. Second, we find that employees can be categorized according to one of the four unique clusters with respect to their behavioral responses to phishing attacks—“Gaffes,” “Beacons,” “Spectators,” and “Gushers.” While each of the clusters exhibits some level of phishing failures and reports, significant variation exists among the employee classifications. Our findings are helpful in driving a new and more holistic stream of research in the realm of all forms of employee responses to phishing attacks, and we provide avenues for such future research.

Phish Derby: Shoring the Human Shield Through Gamified Phishing Attacks

“…No significant interactions (in click-rates or report-rates) between the email template types and job role were observed. Overall, the click-rates were relatively low compared to previously observed campaigns (Canham et al, 2021). This might have been the result of a self-selected sample of participants with knowledge of their contest participation.…”

“…Complementing the research on human-detection capabilities, recent efforts have drawn attention to all potential employee behavioral responses to email phishing attacks (Canham et al, 2021). By analyzing the responses of more than 6,000 employees at a large U.S. university over the course of 20 phishing training campaigns and 19 months, this effort demonstrated that a small subset of users (6% of the total population of users) were responsible for repeated phishing training failures (i.e., "Repeat Clickers") and a larger subset (33%) of users ("Protective Stewards") were responsible for reporting these emails to the Information Security Office.…”

“…Notwithstanding the importance of assessing the number of employees who fall victim to these mock attacks, it is important to note how employees can also have positive reactions to phishing attacks-reactions that alert organizational representatives to the potential threat (Canham et al, 2021). It is unfortunate that many of these positive reactions are often overshadowed by the failures (i.e., successful mock attacks) despite serving as an important warning signal or beacon to the organization that something could be wrong.…”

Examining Factors Impacting the Effectiveness of Anti-Phishing Trainings

“…In 2021, Canham et al 30 investigated phishing related behaviors at a southeastern university in the United States. The focus for this study was on determining employee cluster types for responses to phishing attacks based on positive and negative actions.…”

“…Canham et al noted that security training is "as expected" not perfect as even in the Beacon and Spectator clusters, around 3-4% of the employees fell victim. 30…”