You Know What? - Evaluation of a Personalised Phishing Training Based on Users' Phishing Knowledge and Detection Skills

Training is important to support users in phishing detection. To better match phishing training content with users' current skills, personalised training has huge potential. Therefore, we evaluated personalised training with N=96 participants in an online study. Participants were assigned to one of three groups based on a phishing proficiency score and received tailored training material. The training enhanced overall phishing proficiency, but also levelled the playing field, bringing all groups, regardless of their initial proficiency, to an equivalent post-training phishing proficiency level. For group assignment, the findings show that most person-related information, like age or personality traits, do not seem to affect phishing proficiency in a meaningful way. Yet, security awareness scales like the HAIS-Q or SA-13 seem to be useful indicators of phishing proficiency. The results demonstrate the feasibility of a personalised phishing intervention using relatively sparse data for categorisation into groups that receive tailored training content. Further research is needed to systematically evaluate the benefits and challenges of personalised phishing training.