Markus Schöps, Marco Gutfleisch, Eric Wolter, and M. Angela Sasse, Ruhr University Bochum
Many organizations are concerned about being attacked by phishing emails and buy Simulated Phishing Campaigns (SPC) to measure and reduce their employees' susceptibility to these attacks. Whilst some prior studies reported reduced click rates after SPCs, others have raised concerns that it may have undesirable side effects: causing some employees stress, and/or reducing their self-efficacy. This would be counterproductive, since stress and self-efficacy play a key role in learning and behavior change. We report the first study in which stress and self-efficacy were measured with n = 408 employees immediately after they clicked on or reported a simulated phishing email they received as part of an SPC in a large organization. To obtain richer data how employees experienced the SPC, we conducted semi-structured interviews with n = 21 employees. We find that participants who clicked on and reported simulated phishing emails generally perceived SPCs as positive and effective, even though recent research casts doubt on this effectiveness. We further find that participants who clicked on simulated phishing emails had significantly higher stress levels and significantly lower phishing self-efficacy than participants who reported them. We further discuss the impact of our findings and conclude that the effect of SPCs on the perceived stress of employees is an important relationship that needs to be investigated in future studies.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
![](https://www.usenix.org/sites/all/modules/usenix/usenix_files/images/usenix-locked.png)
author = {Markus Sch{\"o}ps and Marco Gutfleisch and Eric Wolter and M. Angela Sasse},
title = {Simulated Stress: A Case Study of the Effects of a Simulated Phishing Campaign on Employees{\textquoteright} Perception, Stress and {Self-Efficacy}},
booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
year = {2024},
isbn = {978-1-939133-44-1},
address = {Philadelphia, PA},
pages = {4589--4606},
url = {https://www.usenix.org/conference/usenixsecurity24/presentation/sch{\"o}ps},
publisher = {USENIX Association},
month = aug
}