SoK: Still Plenty of Phish in the Sea — A Taxonomy of User-Oriented Phishing
summary
Systematic review of 64 papers (from >2,000 hits) produces a taxonomy of four intervention types and ten subcategories — education, hands‑on training (includes the NoPhish serious game), embedded post‑phish training, awareness warnings (examples include Torpedo that temporarily deactivates links) and design tweaks like domain highlighting. More than half of studies target URL recognition; very few address malware or mobile apps. The paper finds many interventions are time‑consuming, recommends shifting toward during‑decision digital nudges and exploring anti‑malware user interventions.
AI-written summary · about
chapters (4)
related talks
27mBlunting the Phisher's Spear: A Risk-Based Approach...
48mRed Phish, Blue Phish: A New Approach to Phishing Simulations
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
05mAn investigation of phishing awareness and education over time: When and how to best
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
55mPhishing: The War of Infinity