Phishing Training Can Come From Three Mindsets. Can You Tell Which?

Verena Zimmermann of ETH Zürich says the training itself will not tell you whether your organization sees employees as a problem or a partner.

Two organizations roll out phishing training in the same quarter. From the outside, the programs look identical: same modules, same simulated emails, same reporting button. One treats employees as a risk to be contained. The other treats them as colleagues who know something the security team does not. You could audit both for a year and not be able to say which is which.

That is the point Verena Zimmermann, Assistant Professor for Security, Privacy and Society at ETH Zürich, makes in her conversation with Julie Haney and me on the Human-Centered Cybersecurity Series. Phishing training can be classified under a constraining, considering or enabling mindset, and the intervention does not reveal which one is behind it. In her words:

"The intervention itself doesn't necessarily tell us a lot about the mindset that's behind it, and I think that's, that's crucial because that's the starting point." — Verena Zimmermann

I would put it plainly for the business: the mindset decides whether "partners" is a word you can say credibly to your people. Everything else is a control list.

One familiar item, three different aims

Zimmermann uses phishing to make the three mindsets concrete, and the sorting is worth keeping in front of you.

• Constraining: automated attachment blocking, filters, a ban on using work email for private purposes, and compliance training on policies such as not opening attachments from external senders. The aim is making users comply.
• Considering: teaching users to detect phishing, perhaps in a gamified way so the knowledge sticks, and designing warnings that are more salient and better understood. The aim is designing training so people learn better about the threats.
• Enabling: learning from employees who detect phishing reliably and are motivated to report it or warn others, treating the human as part of the solution, or a partner. The aim is switching perspective and learning from users about their challenges, what they do right, what motivates them to report, and their ideas for jointly designing better ways to detect phishing.

Notice how much overlaps. Training shows up in more than one column. A program can run all three without anyone deciding which mindset is steering. That is the exposure: the organization believes it has a strategy, and what it has is an inventory.

Constraining is not the villain

Granted, it is tempting to hear "constraining" and file it under things to stop doing. Zimmermann does not go there. She says blocking likely phishing mail is not necessarily a bad approach, since employees do not want to deal with 100 phishing emails every day, and she says she is not arguing against automation.

Her caution is about where constraint runs out. A ban on private use of work email could pose a challenge where private and work life intersect, and could create insecure situations. And if people are constrained until they cannot do their job, she warns, they build workarounds that lead to insecure situations. Clearly, that is the cost leaders rarely price in: the control that looks tidy on paper pushes risk into places the security team cannot see.

Say "partners" only if the actions match

The enabling mindset asks a different question. Instead of studying only who falls for a phish and why, Zimmermann describes learning from the employees who get it right: to understand "when do things go right and how can we foster this?" The same logic, she says, extends to developers, administrators and others who deal with cybersecurity.

Here is where the business has to be honest with itself. Zimmermann says an organization that tells people they are partners, then ignores their ideas, gives no feedback on reports, or publicly blames and shames someone who clicks, is sending a message that is not credible. Her advice is to be aware of the mindset you want and think it through from communication to action.

I would add one thing. Employees watch what happens to the colleague who clicked. That single moment tells them more about your mindset than any slide in the training deck. The trick, though, is that nobody can see it from the dashboard.

The full article on the blog goes further: Zimmermann's sorting of phishing measures by mindset, why she is not arguing against automation, what learning from success looks like for developers and administrators, and how security leaders can borrow from marketing and product development to apply this in their own programs.

Read the full article: https://www.seanmartin.com/future-of-cybersecurity/verena-zimmermann