Phishing Recognition Lab
Three exercise engines, a library of 42 techniques, and a measurement model that treats over-reporting as a failure.
What this programme claims — and what it does not
The strongest field evidence says awareness training barely moves click rates. Ho et al. (IEEE S&P 2025, 19,500 staff) found no significant relationship between training completion and susceptibility, and that 75% of people spent one minute or less in the content. Lain et al. (ETH Zurich, 14,733 staff, 15 months) found embedded training did not help and plausibly backfired through overconfidence. What held up at scale was reporting by the workforce.
So this programme does not claim to reduce click rates. It trains three things it can defend: discrimination, calibration and reporting. It is built to a 60–90 second attention budget because that is what people actually give. And it treats over-reporting as a first-class failure, scored and penalised, because a programme that floods the security team teaches everyone that reporting is meaningless.
Start here
Library · 42
42 techniques across five families, including 10 campaigns actually reported against Swiss companies, each with the attack mechanism, ranked red flags, and the single check that defeats it.
Framework
The 3-second triage, the 7-point sweep, five verification habits, and the advice to retire.
Practice
Three exercises: email dissection, report-or-ignore, and inbox triage at a realistic base rate.
Profile
Your competency evidence, signal-detection profile and tier.
Deck
Assemble a slide deck from this content and present or print it.
Methodology
How to run a simulation campaign properly: governance, consent, metrics and red lines.