Does Phishing Training Work? What the Controlled Trials Found

Someone has asked you whether the phishing simulation program is worth renewing. The vendor dashboard shows a falling click rate. A colleague has forwarded a headline saying that training doesn’t work. You need a position by the end of the quarter, and neither of those sources is going to give you one.

Two field studies are the closest thing to a direct test. Both ran inside real organizations, both tracked thousands of employees for most of a year or longer, and both compared people who received training with people who did not. That design is rare in security work. Most training claims rest on a before-and-after comparison, and a before-and-after comparison cannot separate the effect of the training from a change in which emails happened to be sent.

In a randomized trial at a large US health system, embedded training cut failure rates by about 2%, and annual awareness training showed no relationship to clicking. A 15-month study at another large employer found no benefit and some signs of harm. Those results do not mean awareness has no value, but they do undercut the program most organizations currently run.

The two studies

What UC San Diego found

The paper by Ho and colleagues reports four results that belong in any budget conversation.

Recency of annual training made no measurable difference. The authors found “no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation.”

Embedded training helped, by very little. The reduction in average failure rate was statistically significant and about 2%. In the study’s detailed results, trained users showed a 1.7% lower failure rate than the control group. An effect that small can be real and still be unimportant for planning.

Most people barely saw the training. More than half of training sessions ended within 10 seconds, and fewer than 24% of users formally completed the material. A program that assumes the lesson is delivered at the moment of failure has to reckon with that.

The choice of email mattered more than the training did. Across the campaigns, one lure about an Outlook password had a failure rate of 1.82%, while a lure about a vacation policy update reached 30.8%. UC San Diego’s summary sets that spread beside the training effect. A swing of nearly 30 points between emails, against a 2-point effect from training, is why a click rate in a dashboard can fall simply because this quarter’s templates were easier.

The study also recorded how exposure builds up. In the first month about 10% of people clicked, and by the eighth month 56% had clicked at least once. That second figure is the one to take to a leadership team that expects a trained workforce to stop failing. Over enough months, a majority of the workforce failed at some point, with or without training.

What ETH Zurich found

The earlier study by Lain, Kostiainen and Čapkun ran longer and reached a sharper conclusion. Embedded training during simulated exercises, as commonly deployed, “does not make employees more resilient to phishing, but instead it can have unexpected side effects that can make employees even more susceptible.” The authors discuss possible reasons, including a false sense of corporate IT security. In their study the training was voluntary, so people could close it. That detail matters when comparing it with mandatory programs.

The study also tested other interventions, and those results get cited less. Warnings placed on top of suspicious emails were effective, and more detailed warnings did not outperform simple ones. The authors also showed that employees acting as collective sensors could detect new campaigns quickly: on average around 10% of reports arrived within 5 minutes and 30% to 40% within 30 minutes, and the reporting load was manageable for the organization.

So one large study supports a reporting button and a plain warning banner while casting doubt on the training page that follows a failed test. That is a different conclusion from “people can’t help.” It says people can help when given a low-effort job that matches how they behave.

What these studies did not test

A fair reading has to include the limits, because a result this unwelcome tends to get overstated in both directions.

• The outcome was clicking a simulated email. Neither study measured real losses, phone-based attacks, or payment fraud. Conclusions about training for a finance team facing a fake vendor call need separate evidence.
• Content varied, and details mattered. Ho and colleagues found that among users who completed interactive training, the likelihood of clicking on a later lure fell by 19%. They caution that this may be a selection effect, since completers differ from non-completers.
• Two organizations are not the whole economy. A hospital and one large employer are informative, but they are not every sector, and these were specific products and settings.
• Other goals are unmeasured. Training may help staff understand policy, know where to report, or meet a compliance requirement. Those are legitimate purposes. They are just not the claim that training reduces phishing clicks.

A way to use this in the renewal decision

Separating the goals is the most useful step. Many programs ask a single annual module and a monthly simulation to do all five jobs, then evaluate them on the one metric that happens to be easy to collect.

If you keep running simulations

Some organizations will continue to run them, because of contract, audit requirement or a reasonable belief that exposure has value. The two studies suggest how to keep the program from doing harm. Stop treating a click as a mark against a person, since most of the workforce will click eventually. Do not make the training punitive, and do not assume that a page shown after a failure will be read. Use the program to measure something you can act on, for instance which lure types or departments see the most reports and which business processes keep producing convincing pretexts. And do not use a rate from one quarter to prove success against another quarter that used different emails.

The strongest takeaway may be a change in the question. “How do we train people not to click?” assumes that noticing is the only available defense. The two studies point to a different question: which decisions should depend on someone noticing at all, and where can the system take that decision away? The authors at UC San Diego landed in the same place, recommending more emphasis on technical countermeasures with better expected returns.

That shift also tends to be easier on employees. If a clicked link can no longer hand over a working password, the click is an event to log and not a failure to remediate. Our article on what awareness training should teach now takes up the content side of this, once the question of what training can accomplish has been answered honestly.

Sources

• Ho et al., Understanding the Efficacy of Phishing Training in Practice (IEEE Symposium on Security and Privacy, 2025): design, failure rates, engagement, interactive-training result.
• UC San Diego Today (September 17, 2025): summary, lure rates, recommendations.
• Lain, Kostiainen and Čapkun, Phishing in Organizations (IEEE S&P 2022; arXiv December 2021): training result, warnings, reporting timeliness.