Response to a phishing attack: persuasion and protection motivation in an organizational context
Information and Computer Security
ISSN: 2056-4961
Article publication date: 9 August 2021
Issue publication date: 31 January 2022
Abstract
Purpose
This study aims to examine the effect of cybersecurity threat and efficacy upon click-through, response to a phishing attack: persuasion and protection motivation in an organizational context.
Design/methodology/approach
In a simulated field trial conducted in a financial institute, via PhishMe, employees were randomly sent one of five possible emails using a set persuasion strategy. Participants were then invited to complete an online survey to identify possible protective factors associated with clicking and reporting behavior (N = 2,918). The items of interest included perceived threat severity, threat susceptibility, response efficacy and personal efficacy.
Findings
The results indicate that response behaviors vary significantly across different persuasion strategies. Perceptions of threat susceptibility increased the likelihood of reporting behavior beyond clicking behavior. Threat susceptibility and organizational response efficacy were also associated with increased odds of not responding to the simulated phishing email attack.
Practical implications
This study again highlights human susceptibility to phishing attacks in the presence of social engineering strategies. The results suggest heightened awareness of phishing threats and responsibility to personal cybersecurity are key to ensuring secure business environments.
Originality/value
The authors extend existing phishing literature by investigating not only click-through behavior, but also no-response and reporting behaviors. Furthermore, the authors observed the relative effectiveness of persuasion strategies used in phishing emails as they compete to manipulate unsafe email behavior.
Keywords
Acknowledgements
The participating organization provided a co-contribution both in kind (access to participants) and financially in order to conduct the research. the organization was not involved in the analysis and interpretation of data; in the writing of the article; nor the decision to submit the article for publication.
Citation
Bayl-Smith, P., Taib, R., Yu, K. and Wiggins, M. (2022), "Response to a phishing attack: persuasion and protection motivation in an organizational context", Information and Computer Security, Vol. 30 No. 1, pp. 63-78. https://doi.org/10.1108/ICS-02-2021-0021
Publisher
:Emerald Publishing Limited
Copyright © 2021, Emerald Publishing Limited