Structure Over Vigilance

A field study by Andrew Rozema and James Davis across 12,511 employees at a financial technology firm found lecture-based and interactive phishing training produced no significant effect on click rates or reporting rates, with negligible effect sizes. What predicted clicking was the difficulty of the lure — about 7% for easy ones against 15% for hard ones.

A separate study found individual susceptibility is not even stable across repeated trials, which undercuts the idea of a reliably phishing-prone person. This work is recent and partly in preprint, so hold it loosely.

Prebunking has better evidence and its own limits. Inoculation research by Jon Roozenbeek, Sander van der Linden and colleagues, including a large randomized field study run through YouTube advertising, shows measurable effects. But a re-examination in an Indian sample found no improvement, and the effects that do appear decay over weeks. Real, perishable, not universally transferable.

Put those together and the conclusion is not despair; it is a change of target. Stop trying to train a person who never makes a mistake and start building a situation where a mistake is survivable. That is a different engineering problem and a tractable one.

Five controls, all set up once. Phishing-resistant sign-in on the email account that recovers everything else. A credit freeze at all three bureaus, free by federal law since 2018. A household rule that large payments go by an instrument with a recovery route. A verification phrase, with every family emergency call hung up and returned on the known number. And a named outside person — an adult child, a sibling, an adviser — who is the agreed second opinion on any large financial decision.

Each of those keeps working while you are exhausted, distracted, grieving and being lied to convincingly, which is the only condition that matters. Vigilance is a resource that runs out. Structure is not.