Blunting the Phisher's Spear: A Risk-Based Approach...
summary
Claims a measurable, individual risk metric replaces one-size-fits-all training: a five-factor SCAM model (suspicion, cognition, automaticity, plus habits and beliefs) explains about 60% of variance in phishing susceptibility from 25 field studies over 6–8 years. Simulated emails yield 30–50% click rates (attachments 20–30%); Verizon reports ~75% of attacks are spearphishing and ~20% of major breaches involve human error. Delivers a 40-question Cyber Risk Index that maps why someone will click and prescribes targeted interventions.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:20Who am I
- 2:30The People Problem
- 5:55Our Research Program
- 9:10Convince People
- 10:05Training Approach
- 11:45Academic Research
- 12:50Recent Study
- 14:05The Problem
- 17:55The Scale Model
- 18:30The Suspicious Cognition Automaticity Model
- 19:35Cognitive Misers
- 21:05Risk Beliefs
- 22:50Device Habits
- 24:05Cyber Risk Index
related talks
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
48mRed Phish, Blue Phish: A New Approach to Phishing Simulations
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It
40mLeveraging Human Risk Data to Strengthen Cyber Resiliency
05mKnowledge and Capabilities that Non-Expert Users Bring to Phishing Detection
54mEmployees Are the New Perimeter- How the Pandemic Shaped Workforce Risk
52mWho Says Cybersecurity Can’t Be Creative?