Sustaining Cyber Awareness: The Long-Term Impact of Continuous Phishing Training and Emotional Triggers

TL;DR

This longitudinal study shows that continuous phishing training combined with emotional triggers significantly reduces employee susceptibility to cyberattacks over a year, emphasizing the importance of ongoing behavioral interventions for organizational security.

Contribution

It provides the first long-term evidence that sustained phishing simulations and emotional cues effectively enhance employee cybersecurity awareness.

Findings

Phishing compromise rates halved within six months.

Employee turnover affects awareness levels.

Ongoing training is crucial for maintaining security awareness.

Abstract

Phishing constitutes more than 90\% of successful cyberattacks globally, remaining one of the most persistent threats to organizational security. Despite organizations tripling their cybersecurity budgets between 2015 and 2025, the human factor continues to pose a critical vulnerability. This study presents a 12-month longitudinal investigation examining how continuous cybersecurity training and emotional cues affect employee susceptibility to phishing. The experiment involved 20 organizations and over 1,300 employees who collectively received more than 13,000 simulated phishing emails engineered with diverse emotional, contextual, and structural characteristics. Behavioral responses were analyzed using non-parametric correlation and regression models to assess the influence of psychological manipulation, message personalization, and perceived email source. Results demonstrate that sustained phishing simulations and targeted training programs lead to a significant reduction in employee susceptibility, halving successful compromise rates within six months. Additionally, employee turnover introduces measurable fluctuations in awareness levels, underscoring the necessity of maintaining continuous training initiatives. These findings provide one of the few long-term perspectives on phishing awareness efficacy, highlighting the strategic importance of ongoing behavioral interventions in strengthening organizational cyber resilience. In order to support open science, we published our email templates, source code, and other materials at https://github.com/CorporatePhishingStudy