--- title: "Phishing training cut failures by 1.7 points; 56% of staff still clicked" summary: "What a randomised trial of 19,789 hospital staff found about phishing training, what NIST now says about passwords, and where the email budget should go, as of September 2026." url: https://www.thetechbag.com/blog/guarding-inbox-essential-email-security-practices-2024 format: Note desk: "Security operations" published: 2026-04-21 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["email security","phishing","security awareness training","phishing simulation","NIST SP 800-63B","passwords","phishing-resistant MFA","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/guarding-inbox-essential-email-security-practices-2024.png --- # Phishing training cut failures by 1.7 points; 56% of staff still clicked *What a randomised trial of 19,789 hospital staff found about phishing training, what NIST now says about passwords, and where the email budget should go, as of September 2026.* Note · Security operations · By TechBag · Published 2026-04-21 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/guarding-inbox-essential-email-security-practices-2024 The short version - Two of the five practices this piece recommended in 2024 have been downgraded by the evidence since: awareness training and forced password changes. - In a randomised trial of 19,789 hospital staff, embedded training lowered phishing failure by 1.7 points on average, and 56% of staff clicked at least one lure in eight months.[1] - Spend the next rupee on the filter and on sign-in that a phishing page cannot replay, not on another course. The 2024 version listed training first, then strong passwords “with regular changes”, then a mail gateway, threat intelligence and encryption. The question an Indian IT lead was asking is which of those to fund first. Two documents published in 2025 answer it more bluntly than any vendor would. ## Training moved failure by 1.7 points; the lure moved it by 29 Researchers at UC San Diego ran ten simulated phishing campaigns over eight months at UC San Diego Health, with randomised control groups. Completing the annual awareness course showed no significant relationship with failing a simulation. Embedded training, shown right after a click, left trained staff with a failure rate on average 1.7 points lower than the untrained control group. In over 75% of training sessions the employee spent less than a minute on the page.[1] [2] **Figure: What the email said mattered far more than whether staff had been trained** *Share of recipients who clicked each simulated phishing lure, UC San Diego Health, eight months between January and October 2023, 19,789 staff* Vacation policy update 30.8% Dress code change 27.7% Traffic ticket 18.6% Building evacuation 10.3% DocuSign request 9.6% OneDrive medical file 9.2% Shared Microsoft document 9% Open enrolment benefits 7.6% Login account problem 1.9% Outlook password update 1.8% | | Value (%) | | --- | --- | | Vacation policy update | 30.8 | | Dress code change | 27.7 | | Traffic ticket | 18.6 | | Building evacuation | 10.3 | | DocuSign request | 9.6 | | OneDrive medical file | 9.2 | | Shared Microsoft document | 9 | | Open enrolment benefits | 7.6 | | Login account problem | 1.9 | | Outlook password update | 1.8 | Source: Ho et al., Understanding the Efficacy of Phishing Training in Practice, IEEE S&P 2025, Table 1 · as of May 2025 Our view Our view: staff have learned the password-reset lure, at 1.8%, and still open an HR policy change, at 30.8%. Attackers will write the second kind. Plan for the click and make it cheap. The evidence against us: the trial measured clicks, not typed passwords, at one US hospital, and staff who completed interactive training did fail less afterwards. ## Stop forcing password changes; offer phishing-resistant sign-in NIST’s SP 800-63B-4, published in July 2025, says verifiers “SHALL NOT require subscribers to change passwords periodically”, bans composition rules, sets 15 characters as the minimum for a password used alone, and requires services at AAL2 to offer a phishing-resistant option.[3] [4] The 2024 advice to enforce regular changes is withdrawn. The trial’s authors point the same way: hardware second factors and password managers that fill credentials only on the correct domain.[1] ## Cost and rules in India Filtering is the cheap layer. Proofpoint Essentials lists from US$2 a user a month and Forcepoint Email Security at US$2.40; both are USD lists invoiced in INR with 18% GST, so US$2 is about ₹2,040 a user a year before tax at ₹85 to the dollar.[5] CERT-In’s Directions of 28 April 2022 list phishing attacks among incidents to report within six hours.[6] The DPDP Rules, notified on 13 November 2025, bring security-safeguard and breach-intimation duties into force on 13 May 2027.[7] How we did this Figures as of 30 September 2026 Lure failure rates and the 1.7-point training effect are from the paper’s own tables; the engagement figure is its count of training sessions. The NIST requirements were read from the published SP 800-63B-4 text. Filter prices are from TechBag’s email security guide as it stood on 30 September 2026. Rupee figures assume ₹85 to the dollar. The original’s five product blurbs are not repeated; the products are compared in the guide. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Ho, Mirian, Luo et al., Understanding the Efficacy of Phishing Training in Practice (IEEE Symposium on Security and Privacy)](https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf) — May 2025 2. [UC San Diego Today, Cybersecurity training programs don't prevent employees from falling for phishing scams](https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams) — 17 September 2025 3. [NIST, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (publication record)](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) — July 2025 4. [NIST, SP 800-63B-4 text (password and phishing-resistance requirements)](https://pages.nist.gov/800-63-4/sp800-63b.html) — July 2025 5. [TechBag, Email & collaboration security guide (22 products; Proofpoint Essentials and Forcepoint list prices)](https://www.thetechbag.com/browse/security/email-security) — vendor-doc-verified 22 August 2026 6. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (six-hour reporting; Annexure I incident types)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 7. [Digital Personal Data Protection Rules, 2025: phased commencement](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 Related on TechBag: the [email security guide](https://www.thetechbag.com/browse/security/email-security) compares 22 filters, DMARC and awareness products; the [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) covers phishing-resistant sign-in. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Email & collaboration security guide](https://www.thetechbag.com/browse/security/email-security) — 22 filters, DMARC and awareness products, priced where vendors print it - [IAM, SSO & MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — phishing-resistant sign-in, compared