Why People Click, lessons from qualitative research

Value of the Information & Strength of the Argument

The talk provides valuable insights from a large real-world dataset, which is rare in this field. The argumentation is generally solid, with data supporting claims about training decay and the distinction between clicking and reporting. However, some interpretations are speculative, such as the reasons for the Monday morning peak, which the speakers admit did not match their hypothesis. The use of PMT is well-explained and adds theoretical grounding. The discussion of security fatigue is supported by data on click and report rates. Overall, the value is high for practitioners, but the scientific rigor is moderate due to the qualitative nature and potential biases in self-reported data.

Scientific Rigor, Source Quality, Title Accuracy

The speakers cite several sources, including the Ho et al. study from UCSD and the Hawthorne effect, but they do not provide specific citations for all claims. The data presented is from Beauceron’s own platform, which is a primary source but may have selection bias. The title accurately reflects the content. The talk is not peer-reviewed, but it is based on a large dataset and references established theories. The description includes links to relevant resources, such as HC2P and Beauceron, which add credibility. The Q&A section addresses common concerns and clarifies points. Overall, the scientific rigor is moderate, with a good balance of data and interpretation.

The title accurately reflects the content, which focuses on qualitative insights into why people click on phishing simulations.

7/10

The talk is based on a large dataset (170k people, 15M simulations) and references academic concepts (PMT, Hawthorne effect), but the analysis is largely qualitative and the speakers are industry practitioners rather than academic researchers. The claims are generally supported by data, but some interpretations are speculative.

• 00:00Welcome & Introductions
• 03:49What “cyber” really means: cybernetics, humans–technology–control
• 06:03Why humans matter in cyber defence
• 07:53Phishing 101
• 09:29Do phishing simulations work?
• 13:04Beauceron dataset: 1,300 orgs, 170k people, 15M simulations
• 14:02Training decay over time
• 21:31When people click
• 23:43Security fatigue
• 25:12Attitudes & risk
• 28:56Over‑trusting security tools doubles risk
• 30:49“Aggressive mimicry”
• 33:09Emotions & clicks
• 38:36Monday morning myth?
• 40:53Teach in the moment
• 41:13Why people clicked
• 42:39Habits, vigilance & better training design
• 42:54“Phishing tests = fire drills?”
• 45:03Q&A begins
• 45:24Q1: Why people still click after training
• 50:37Q2: Attitudes/beliefs that increase phishing vulnerability
• 53:06Q3: Fear‑based vs. empowerment‑based awareness campaigns
• 56:21Closing remarks

• Cybercrimeology podcast — Michael Joyce's podcast discussing cybercrime science and research.
• Human-Centric Cybersecurity Partnership (HC2P) — Michael Joyce's organization, a transdisciplinary group researching human-centric cybersecurity.
• Canada's Smart Cybersecurity Network (SERENE-RISC) — Network for cybercrime and cybersecurity knowledge mobilization.
• Cybercrime prevention laboratory — Michael Joyce's research lab at the University of Montreal.
• Canadian Institute for Cybersecurity — Hosting institution and David Shipley's alma mater.
• CIC webinar introduction video — Video about the Canadian Institute for Cybersecurity.

• Ho et al. (UCSD) study on phishing training — Referenced in the talk as showing that some training methods are ineffective, but the talk argues that other methods can be effective.

• Claims that security awareness training doesn't work — The speakers argue that such claims are oversimplified and not supported by all evidence.

• cyberdailyreport.com
• www.linkedin.com