Phishing susceptibility: The good, the bad, and the ugly

Phishing website-based attacks remain pervasive, with high user susceptibility continuing to be a major factor. In this study we use cluster analysis coupled with an elaborate controlled experiment involving hundreds of participants to identify and examine high susceptibility user segments in terms of their perceptions, demographics, and phishing website traversal behavior. The results reveal three sets of users, including two sets that exhibit highly problematic behavior. The results have important implications for training programs, usability of anti-phishing tools, and security policies.