Phishing training cut failures by 1.7 points; 56% of staff still clicked
What a randomised trial of 19,789 hospital staff found about phishing training, what NIST now says about passwords, and where the email budget should go, as of September 2026.
The 2024 version listed training first, then strong passwords “with regular changes”, then a mail gateway, threat intelligence and encryption. The question an Indian IT lead was asking is which of those to fund first. Two documents published in 2025 answer it more bluntly than any vendor would.
01Training moved failure by 1.7 points; the lure moved it by 29
Researchers at UC San Diego ran ten simulated phishing campaigns over eight months at UC San Diego Health, with randomised control groups. Completing the annual awareness course showed no significant relationship with failing a simulation. Embedded training, shown right after a click, left trained staff with a failure rate on average 1.7 points lower than the untrained control group. In over 75% of training sessions the employee spent less than a minute on the page.1 2
What the email said mattered far more than whether staff had been trained
Share of recipients who clicked each simulated phishing lure, UC San Diego Health, eight months between January and October 2023, 19,789 staff
Source: Ho et al., Understanding the Efficacy of Phishing Training in Practice, IEEE S&P 2025, Table 1 · as of May 2025
02Stop forcing password changes; offer phishing-resistant sign-in
NIST’s SP 800-63B-4, published in July 2025, says verifiers “SHALL NOT require subscribers to change passwords periodically”, bans composition rules, sets 15 characters as the minimum for a password used alone, and requires services at AAL2 to offer a phishing-resistant option.3 4 The 2024 advice to enforce regular changes is withdrawn. The trial’s authors point the same way: hardware second factors and password managers that fill credentials only on the correct domain.1
03Cost and rules in India
Filtering is the cheap layer. Proofpoint Essentials lists from US$2 a user a month and Forcepoint Email Security at US$2.40; both are USD lists invoiced in INR with 18% GST, so US$2 is about ₹2,040 a user a year before tax at ₹85 to the dollar.5 CERT-In’s Directions of 28 April 2022 list phishing attacks among incidents to report within six hours.6 The DPDP Rules, notified on 13 November 2025, bring security-safeguard and breach-intimation duties into force on 13 May 2027.7
Sources
- Ho, Mirian, Luo et al., Understanding the Efficacy of Phishing Training in Practice (IEEE Symposium on Security and Privacy) — May 2025
- UC San Diego Today, Cybersecurity training programs don't prevent employees from falling for phishing scams — 17 September 2025
- NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (publication record) — July 2025
- NIST, SP 800-63B-4 text (password and phishing-resistance requirements) — July 2025
- TechBag, Email & collaboration security guide (22 products; Proofpoint Essentials and Forcepoint list prices) — vendor-doc-verified 22 August 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; Annexure I incident types) — 28 April 2022
- Digital Personal Data Protection Rules, 2025: phased commencement — notified 13 November 2025
Related on TechBag: the email security guide compares 22 filters, DMARC and awareness products; the IAM, SSO and MFA guide covers phishing-resistant sign-in.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
