Simulated Phishing Training Exercises versus Gamified Phishing Education Games

Abstract

Phishing, a type of social engineering attack, continues to be a problem, and anti-phishing approaches must be implemented to stymie these attacks. With the rise of new educational methods that go beyond lecture-based, the question is whether there is a modern approach to education. One method that has existed for years is that of simulated phishing training, but it is thought that there needs to be a more engaging approach to this area of education. Gamification in phishing education is a more recent but not extremely well studied approach, which leads to the question – Which is better for phishing education of users, simulated phishing exercises or gamified phishing training? In this report, five research articles in each category are described and summarized, and then an analysis is conducted within the groups and between the two groups. The analysis is focused on quantitative metrics that appear in the selected research articles; there is a lesser focus on the qualitative analysis conducted in the reviewed reports. From this comparative analysis, gamified phishing training appears to be a more suitable method of educating users, as it reduces susceptibility and engages students at a higher level of learning.