The Phishing Funnel Model: A Design Artifact to Predict User Susceptibility to Phishing Websites

Abstract

Phishing is a significant security concern for organizations, threatening employees and members of the public. Phishing threats against employees can lead to severe security incidents, whereas those against the public can undermine trust, satisfaction, and brand equity. At the root of the problem is the inability of Internet users to identify phishing attacks even when using anti-phishing tools. We propose the phishing funnel model (PFM), a framework for predicting user susceptibility to phishing websites. PFM incorporates user, threat, and tool-related factors to predict actions during four key stages of the phishing process: visit, browse, consider legitimate, and intention to transact. We evaluated the efficacy of PFM in a 12-month longitudinal field experiment in two organizations involving 1,278 employees and 49,373 phishing interactions. PFM significantly outperformed competing models in terms of its ability to predict user susceptibility to phishing attacks. A follow-up three-month field study revealed that employees using PFM were significantly less likely to interact with phishing threats relative to comparison models and baseline warnings. Results of a cost-benefit analysis suggest that interventions guided by PFM could reduce annual phishing-related costs by nearly $1,900 per employee relative to comparison prediction methods.

Predicting User Susceptibility to Phishing Based on Multidimensional Features

“…Therefore, an increasing number of researchers are shifting their focus to the analysis of user susceptibility. Phishing susceptibility is the degree to which users interact with phishing attacks [ 6 ]. Over time, researchers have made some progress and proposed various phishing susceptibility models that explain or describe the factors behind phishing susceptibility [ 7 , 8 ].…”

“…The literature [ 6 ] considers demographic information as an important factor of phishing susceptibility and argues that demographic characteristics contain human vulnerability, which is the focus of research.…”

The Current State of ―Information Security Awareness‖ in German SMEs

“…In addition, current studies within our literature search show again that despite increasing digitization, there is still a lack of comprehensive awareness of IS in SMEs and, even if the risk perception has increased, there is a lack of holistic implementation of diverse security measures, including ongoing awareness campaigns. The extensive literature search by Chowdhury and Gkioulos on training methods shows that solutions that provide hands-on experience, team-skills development and high levels of real-life fidelity are often preferred to other options, with simulation-based solutions showing the highest amount of research and development [57]. Nonetheless, there is still a gap in the research on how to improve current cybersecurity training offerings to demonstrate whether integrating advantageous attributes from different delivery methods can produce more comprehensive and effective solutions [57].…”

“…The extensive literature search by Chowdhury and Gkioulos on training methods shows that solutions that provide hands-on experience, team-skills development and high levels of real-life fidelity are often preferred to other options, with simulation-based solutions showing the highest amount of research and development [57]. Nonetheless, there is still a gap in the research on how to improve current cybersecurity training offerings to demonstrate whether integrating advantageous attributes from different delivery methods can produce more comprehensive and effective solutions [57]. Our project will help to fill this gap in the next two years.…”

Design of a Chatbot Social Engineering Victim

“…The challenge of SE is that it circumvents technical security measures and exploits human decision-making to gather information [4]. Building an effective defense against SE in an organization frequently involves training and development of effective policies to encourage employees to adhere to good security practices.…”