Testing PhishGuru in the Real World

In real world testing of PhishGuru, an embedded training system that teaches people how to protect themselves from phishing attacks, we found (a) PhishGuru is effective in training people in the real world; (b) users retained knowledge when trained with PhishGuru in the real world; (c) a large percentage of people who clicked on links in simulated emails proceeded to give some form of personal information in the real world; (d) people trained with spear phishing specific training material did not make better decisions in identifying spear phishing emails compared to people trained with generic training material. We also observed that PhishGuru training could be effective in training other people in the organization who did not receive training messages directly from the system.