How to Defend Against Phishing in Universities: Do Simulations Really Work?

Universities are prime targets for digital scammers: students, professors and staff share hundreds of accounts and receive daily emails. A team of Croatian researchers tested two defence strategies: phishing simulations and an online security course. They ran three simulated attack phases, each aimed at different departments, and a targeted training module. The findings show that after the course, the number of compromised users dropped only slightly, and the difference was not statistically significant compared to simulations alone. The third simulation, launched just before the holidays, saw a spike in clicks on malicious links, highlighting how fatigue and timing can weaken vigilance. In practice, neither simulations nor isolated training are enough for solid protection. The authors recommend a continuous approach that blends practical exercises, regular updates and contextualised threat awareness. Only then can academic communities turn awareness into a real shield against phishing.

The project employed a controlled experimental design, randomising departments across the three simulation conditions and the training group. Evaluation metrics included click‑through rates on fraudulent links, reporting of suspicious emails, and average response time. Statistical analysis used chi‑square tests to compare compromise proportions and logistic regressions to assess the influence of demographic variables (age, academic role, educational background). Results showed a weak correlation between older age and higher likelihood of falling for the trap, likely due to less updated digital habits. Moreover, the model indicated that the "pre‑holiday period" variable was a significant predictor of vulnerability, with an odds ratio of about 2.5. From a psychological perspective, cognitive load theory explains how information overload and seasonal stress reduce the ability to process warning signals. These findings suggest awareness campaigns should be integrated with pause and review moments, avoiding informational overload. Finally, analysis revealed that repeated simulations, when well spaced over time, improve long‑term resilience, but only if accompanied by personalised feedback and a continuous learning context rather than isolated sessions. This hybrid approach can foster more robust mental models capable of recognising phishing patterns even in new, sophisticated scenarios.