We've All Been Wrong: Phishing Training Doesn't Work

**Executive summary:** A large-scale 2023 study of 19,789 UCSD Health employees found that typical phishing awareness programs have minimal real-world impact: interactive, engaging training produced the largest benefit (about a 19% reduction in click likelihood for the best group), static or repetitive trainings showed no benefit and sometimes increased susceptibility, and overall improvement was negligible (~1.7%); the researchers recommend prioritizing technical mitigations (e.g., hardware 2FA) and investigating more effective or individualized training approaches.