Why Preventing Phishing Is So Difficult, and What We Can Do About It

Explore the persistent challenge of phishing attacks through groundbreaking research findings in this 31-minute conference talk from NorthSec 2025. Delve into why phishing remains effective despite increased cybersecurity awareness and examine human decision-making patterns that make users vulnerable to these attacks. Learn from one of the largest independent studies of phishing behavior conducted in Canada, spanning five years of comprehensive research that challenges common assumptions about security training effectiveness. Discover critical insights including the most dangerous times and days for phishing attacks, optimal frequencies for cybersecurity training to balance reinforcement with security fatigue, and the real-world impact of Cybersecurity Awareness Month on user behavior. Investigate how strong technical security measures might paradoxically increase phishing risk and understand the psychological factors that drive user susceptibility. Gain practical, data-driven approaches to phishing mitigation that account for human behavior patterns, learn why traditional training methods often fail, and understand the strategic value of phishing simulations. Access evidence-based strategies for designing more effective security programs while debunking common misconceptions about user behavior in cybersecurity contexts. The presentation draws from PhD research conducted at the University of Montreal in collaboration with Beauceron Security, offering unique insights into phishing psychology and presenting findings publicly for the first time.