Phishing With a Net: The NIST Phish Scale and Cybersecurity Awareness
summary
NIST researchers present a measurable system that explains why click rates vary: after 4.5 years and 15 simulated exercises they build the NIST Phish Scale that scores emails by 23 cues plus premise alignment to produce a detection difficulty rating. Filters still let ~10% of malicious mail through; highly aligned but low-cue emails hit almost 50% click rate (an unpaid-invoice variant hit ~20%). The tool is usable by training implementers, supports job-family granularity, and matches survey evidence about reality-checking behaviors.
AI-written summary · about
chapters (8)
- 0:00Introduction to NIST Phish Scale
- 1:05Phishing threats and training landscape
- 6:27Human element in phishing decisions
- 13:16NIST Phish Scale explained
- 16:27Applying the Phish Scale in practice
- 23:42Tailoring Phish Scale to job families
- 26:57Actionable guidance and takeaways
- 30:18Q&A session
related talks
27mBlunting the Phisher's Spear: A Risk-Based Approach...
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
05mKnowledge and Capabilities that Non-Expert Users Bring to Phishing Detection
16mChecking, nudging or scoring? Evaluating e-mail user security tools
06mSoK: Still Plenty of Phish in the Sea — A Taxonomy of User-Oriented Phishing
38mClick Here Now: A Positive Way to Create Phishing Awareness
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It
48mRed Phish, Blue Phish: A New Approach to Phishing Simulations