A field study of 12,511 employees found lecture-based and interactive phishing training produced no significant effect on click or report rates, while lure difficulty predicted clicking — about 7% for easy lures against 15% for difficult ones. What is the defensible conclusion?
