--- title: Phishing Training Makes Employees More Prone to be Phished description: Embedded training after phishing simulation exercises may not make employees more resilient to phishing, but it can actually have unexpected side effects. image: https://blog.cybercoach.com/hubfs/new%20phishing%20banner.svg --- [![CyberCoach Full Logo with Bot Icon](https://blog.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - [English](https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished) - [Suomi](https://blog.cybercoach.com/fi/phishing-training-makes-employees-more-prone-to-be-phished) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly. ](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training. ](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.  ](https://www.cybercoach.com/eu-ai-act-training-requirements?hsLang=en) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) - [English](https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished) - [Suomi](https://blog.cybercoach.com/fi/phishing-training-makes-employees-more-prone-to-be-phished) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) Training # Phishing Training Makes Employees More Prone to be Phished Embedded training after phishing simulation exercises may not make employees more resilient to phishing, but it can actually have unexpected side effects. [Maria Bique](https://blog.cybercoach.com/author/maria-bique) Feb 23, 2023 [Awareness](https://blog.cybercoach.com/tag/awareness) [Phishing](https://blog.cybercoach.com/tag/phishing) [Training](https://blog.cybercoach.com/tag/training) ### Share this article [mailto:?subject=Check%20out%20https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished&utm_medium=social&utm_source=email](mailto:?subject=Check%20out%20https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished&utm_medium=social&utm_source=email) ### Subscribe ### Subscribe ![](https://blog.cybercoach.com/hubfs/new%20phishing%20banner.svg) An entire phishing simulation industry has emerged to combat the dangers of phishing attacks on individuals and organizations. To an engineer, the approach makes sense: People click on links. Let's send people practice emails and see if they click. If they click, let's give them additional training, so that they will not click again. Phishing simulation service providers present data that suggests their approach is effective, but the scientific community is far from agreeing. Many studies on simulated phishing effectiveness suffer from small sample sizes and/or a lack of diversity among the participants. So the science is still very much out. A recent study\* suggests employees that receive phishing training may actually be more prone to dangerous actions when they receive phishing emails. Wait, what?  Direct negative impact of phishing simulation training ![Large scale study on phishing susceptibility over time indicates phishing simulations combined with contextual training actually lead to employees taking more dangerous actions in response to phishing emails.](https://blog.cybercoach.com/hs-fs/hubfs/phishing%20study%20results.png?width=1656&height=1040&name=phishing%20study%20results.png) This large-scale study by the Department of Computer Science ETH Zurich in Switzerland\* sought to measure the effectiveness of phishing simulation exercises, as well as the effectiveness of combining phishing simulations with contextual training. Contextual training refers to a common practice of forwarding participants that clicked or took dangerous actions to training pages immediately after their mistake. The study found that both click (+16%) and dangerous actions rates were higher (+27%) for participants that received contextual training after falling for simulated phishes. How is that possible? The researchers tried to dig deeper with a survey. Based on the survey results, they suspected that employees who were directed to training pages may have experienced a false sense of security. They may have felt more confident in their employers being able to protect them, so no need to be too cautious. They may have also felt that incoming phishes were likely just tests, so no risk in clicking.  It is also worth noting that they conducted this study at an organization that employs "people with different duties: field workers, branch workers that work in front-end stores in contact with the general public, and office workers of different qualifications, from IT to marketing and accounting." Results may have been different, for instance, in an IT or tech company with primarily highly technically skilled employees. It is also possible that the contextual training just was not that good. We need more science to understand why contextual training did more harm than good, and what we can do to make training more effective.  Indirect negative impact of phishing simulation training Because phishing simulations make sense and can at least *seem* effective, we hardly talk about their indirect negative impact. Yet, various studies suggest that simulated phishing campaigns hurt both employees’ trust in their own abilities (self-efficacy) and their trust in the organization. Both easily negatively affect other organizational goals. Both are easily understandable results of your own organization tricking you, and you falling for it.  What choice do we have? Phishing remains a big problem that technical controls still cannot mitigate adequately. Employee skills are essential. The cited study suggests improving employee reporting of phishing incidents by increasing transparency and making reporting more rewarding for employees. This is a low-cost way of improving an organization's resilience to phishing attacks. Rewarding crowd-sourcing of phishing detection also has positive effects on: - **Employee's trust in the organization.** When the security team informs about how they managed the incident after the employee reported it, it further encourages reporting and strengthens trust in how the organization operates. - **Employee's self-efficacy. **Through rewarding and learning about the impact of your action, you gain confidence in your own abilities and learn that your organization valued your effort.   It is also possible to provide hands-on phishing education that does not damage employee's self-efficacy and trust in the organization. The key there too is transparency. We should never administer phishing simulations without prior warning, and at least optional pre-test training. We should also take care to ensure training materials and messaging are inclusive.  Phishing simulation training has become the status quo of security training. If phishing training is ineffective or doing more harm than good, what will it take for us as an industry to move on?  \*D. Lain, K. Kostiainen and S. Čapkun, "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study," *2022 IEEE Symposium on Security and Privacy (SP)*, San Francisco, CA, USA, 2022, pp. 842-859, doi: 10.1109/SP46214.2022.9833766. ## Similar posts Security Culture ### [Are you Managing Human Risk or Educating People?](https://blog.cybercoach.com/managing-human-risk?hsLang=en) Discover why trust is more effective than control and learn how modern learning platforms like CyberCoach empower employees to take ownership of... Maria Bique Sep 15, 2023 Awareness ### [Four Ways CyberCoach Security Awareness Training Enhances Modern Work Culture](https://blog.cybercoach.com/four-ways-cybercoach-enhances-modern-work-culture?hsLang=en) Discover how CyberCoach's security awareness training empowers modern work culture by embracing autonomy, seamless integration, and building... Maria Bique May 23, 2023 Cyber Social Responsibility ### [Liquid C2 and CyberCoach partner to bring a safer digital environment to African businesses](https://blog.cybercoach.com/liquid-c2-and-cybercoach-partner?hsLang=en) We are proud to collaborate with Liquid C2, whose scale, values, and commitment to digital empowerment in Africa align strongly with our mission. Dana Paredes Mar 11, 2026 ### Get notified of what's going on in AI and security awareness and compliance **Expert Tips:** Stay informed with curated content, expert opinions, and case studies that are relevant to your organization's security awareness strategy. **Special Offers:** Access to CyberCoach promotions and campaigns.  **Stay Informed:** Get the latest insights and updates on security and AI compliance trends, threats, and best practices delivered directly to your inbox. ![cybercoach_logo_white.svg.2023_03_15_16_58_04.0](https://blog.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Maria Bique", "url" : "https://blog.cybercoach.com/author/maria-bique" }, "dateModified" : "2025-01-10T19:27:17.504Z", "datePublished" : "2023-02-23T17:38:54.000Z", "headline" : "Phishing Training Makes Employees More Prone to be Phished", "image" : [ "https://blog.cybercoach.com/hubfs/new%20phishing%20banner.svg" ], "mainEntityOfPage" : { "@id" : "https://blog.cybercoach.com/phishing-training-makes-employees-more-prone-to-be-phished", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.cybercoach.com/hubfs/cybercoach_marketplace_icon.svg" }, "name" : "CyberCoach" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```