Phishing Vulnerability and Resilience: A Workplace Study in Saudi Arabia

A phishing vulnerability assessment (PVA) typically involves sending a mock phishing email (a lure) to a predefined target group. The subsequent frequency of victimhood - compliance with the phishing email’s intentions – is indicative of an organization’s vulnerability or resilience to real-world phishing scams. This study examined the outcomes of a monthly workplace PVA between 2016 and 2023, also exploring the socio-demographic predictors of vulnerability and resilience. Overall, vulnerability decreased over the study period. Bivariate regression analysis suggests that several socio-demographic factors are reliably associated with vulnerability and resilience. The PVA approach is ecologically valid and can facilitate pan-organizational cyber-threat awareness, potentially leading to heightened vigilance, reporting and reduced susceptibility to phishing attacks. Targeted training interventions may be merited for certain vulnerable groups.