Improving cybersecurity awareness using phishing attack simulation

Abstract

This paper aims to present a case study of the cybersecurity awareness level of the workers in a financial institution in Thailand. In this study, there were 2 phases of cyber drills using a spear-phishing email. The first phase was conducted with more than 20,300 workers. It was found that there were 23.25% of potential victims. However, the second phase was conducted four months later with more than 20,200 workers after performing knowledge transfer. The number of workers who opened phishing emails in the second phase decreased to 6.76% only. Therefore, it can be indicated that an appropriate cybersecurity knowledge transfer can reduce a large number of potential victims and cyber threats that may occur in such organizations.