Cost-Sensitive User Modeling for Predicting Phishing Susceptibility

User susceptibility to phishing poses challenges for security in organizational and consumer environments. Recent work on user modeling has demonstrated the potential for predicting user engagement behaviors with phishing threats (e.g., click through rates). In this study, we adopt a cost-sensitive user modeling framework for predicting user susceptibility to phishing attacks. Our framework includes three model cost-benefit levels, including asymmetric false positive/negative costs, as well as user-threat heterogeneity in the form of model architecture design as well as inclusion of instance-level costs. Results on a large organizational testbed spanning 19 months and 86,604 user-phishing encounters related to over 1,000 employees reveals that the proposed framework is able to predict user phishing URL clicks/engagement more accurately and precisely than benchmark methods, resulting in markedly lower misclassification costs. The results have important implications for security behavior prediction research and practice.