Simulating cyber defense: the impact of phishing training and system updates on mitigating damage from hybrid phishing and watering hole attacks

As technology advances and organizations implement more robust security systems, it has become increasingly difficult for cybercriminals to penetrate these defenses using purely technical methods. In response, cybercriminal groups start to leverage techniques that exploit human errors within the organization to bypass security systems. The two most critical human mistakes that can occur within an organization are clicking on links or downloading files from suspicious emails and failing to update operating systems, software, or browsers in a timely manner. In this paper, we simulate hybrid spearphishing and watering hole attacks to analyze the actual effectiveness of investments in phishing education and system updates. Each simulation adjusts the level of phishing training and the employees’ proactivity in system updates to evaluate how these measures effectively reduce organizational vulnerability to cyber attacks. This study clarifies the efficacy of cybersecurity investments, assisting organizations to establish security policies based on clearer evidence.