For two decades, the standard answer to phishing has been to train the human: annual modules, simulated phishing, “think before you click” posters. The assumption underneath all of it is that people are the firewall. The evidence increasingly says they aren’t — and the most effective modern attacks are built specifically to defeat the one habit training tries to instil.
The largest study to date barely moved the needle
In 2025, researchers at UC San Diego Health ran the largest controlled experiment yet on anti-phishing training: roughly 19,500 employees, ten campaigns, eight months, using a randomized design. [1] The results were bleak. There was no meaningful difference between employees who’d completed mandatory annual training and those who hadn’t. “Embedded” training — the just-in-time lesson shown the moment someone clicks — reduced the likelihood of clicking by about two percentage points. [2] And people got worse over time: about 10% clicked in the first month; by the eighth, more than half had clicked at least one lure.
The researchers’ own conclusion was blunt: as currently administered, none of the training approaches they tested were effective, and they recommended refocusing on technical countermeasures.
The gains that do appear tend to evaporate
Training vendors point to real reductions over a year of repeated practice, and that’s a fair counterpoint. [5] But independent reviews keep finding that improvements measured right after training fade within months — in one body of research, gains visible at four months had vanished by six. [3] As one researcher put it, our habits have more inertia than the nudges we receive. There’s a subtler risk too: training can breed overconfidence, which is the wrong instinct when the next lure is better than the last.
Even a trained workforce is fighting the clock
Verizon’s 2025 data put the median time from opening a phishing email to clicking at 21 seconds, and found roughly one in three who click go on to enter credentials. [4] A defense that depends on a tired human making the right call, in seconds, dozens of times a day, will eventually fail. The attacker only has to win once.
The technique that turns training against you: browser-in-the-browser
The single most repeated piece of phishing advice is “check the URL.” Browser-in-the-browser (BitB) attacks exist to make that advice worthless. Documented in 2022 by the researcher known as mr.d0x, a BitB attack draws a fake browser pop-up inside the real page using ordinary HTML, CSS and JavaScript. [5] When you click “Sign in with Google,” the attacker paints a pixel-perfect copy of that window — convincing title bar, padlock icon, and a legitimate-looking address bar showing the real domain. The address bar is just styled text. It can say anything.
The technique even defeats hovering to preview a link: a small script can show the genuine address on hover and ignore it on click. So the user does everything they were taught — checks the URL, sees the right domain, sees the padlock — and types their password straight to the attacker. This isn’t theoretical: BitB lures have stolen gaming accounts reportedly worth up to $300,000 and been folded into the toolkit of state-aligned groups. [6]
Catch the fake the eye can’t
A pixel-perfect BitB window beats every visual check. SafeToOpen analyses the page itself in real time — so the fake is caught even when it looks perfect.
How Browser Security works →Awareness is a layer, not a control
Training isn’t worthless — a workforce that reports suspicious messages quickly genuinely helps. But human awareness can’t be the primary defense, because the human can always be fooled, the effect fades, and the best attacks are built to beat the exact checks we teach. The organizations getting this right shift weight to controls that don’t depend on a person being right in 21 seconds: phishing-resistant authentication, and detection that judges the page as it loads.