Evaluating the effectiveness of Security Education, Training and Awareness (SETA) programmes on positively influencing human behaviour towards phishing emails

Security, Education, Training and Awareness (SETA) programmes are implemented within organisations to provide users with the necessary knowledge to recognise cybersecurity threats and to respond to them in an effective and responsible manner. A key challenge with SETA programmes is measuring its overall effectiveness and which awareness and training initiatives should be prioritised. The study explores how those responsible for delivering SETA programmes can optimise its delivery to positively influence user behaviour towards phishing emails. This case study within an Irish Public Sector Body (PSB) uses a mixed-method methodology of both quantitative and qualitative elements, structured around three hypotheses which examine the impact on human behaviour when exposed to different SETA initiatives. The research examines over 12,000 user actions during phishing simulation tests during a 3-year period. Overall, the research presents a ‘recommended approach’ for designing and implementing a SETA programme to address human behavioural vulnerabilities related to phishing emails.