Phishing Awareness Training and Employee Behaviour: A Human-Centered Evaluation Framework

Phishing remains a persistent cybersecurity problem because technical controls cannot prevent every unsafe decision made by employees. This study presents a human-centered framework for evaluating phishing-awareness training through measurable changes in knowledge and behaviour. The proposed design uses a quantitative, quasi-experimental pre-test/post-test approach in a hypothetical sample of 150 employees from IT, Human Resources and Finance. The evaluation combines a structured questionnaire, safe simulated-phishing exercises and learning-platform records. Key outcomes are click rate, suspicious-email reporting rate, knowledge score and response time. The intervention uses short microlearning modules, realistic but controlled simulations, immediate feedback and a non-punitive reporting process. The manuscript also demonstrates how Protection Motivation Theory, the Theory of Planned Behaviour and Expectancy-Value Theory can explain the movement from awareness to protective action. Illustrative results show a decline in click rate from 32.0% to 11.3%, an increase in reporting from 18.0% to 57.3%, and an increase in mean knowledge score from 62 to 84. These values are explicitly illustrative and are not presented as observations from a real organization. The study therefore provides a transparent evaluation model that can be reused with actual organizational data after ethical approval and appropriate authorization.