Designing a security awareness program against phishing attacks based on best practices for an organisational setting

Phishing attacks are one of the biggest threats that organizations face in today's society. Despite new advancements in detecting these types of threats with the help of machine learning, the human factor is still the biggest vulnerability that is being exploited by attackers. This thesis investigates the best practices for mitigating or preventing phishing attacks against organizations and design a security awareness program from these practices. The methods being used are literature review complemented with semi-structured interviews with employees working in cybersecurity within an organization. The collected research data indicates a rapid growth of phishing attacks, especially with the help of AI, and as a result of this the security awareness training needs to keep up with these developments and be conducted regularly. The findings will help design an effective security awareness program based on the best practices from the data collected.