Courses, Clicks and Consequences: Empiricizing Enterprise Security

We speak with Dr Grant Ho from the University of Chicago about a large-scale field evaluation of anti-phishing training inside a major health organisation. The conversation examines annual awareness training, embedded “teach-at-click” exercises, and the role that engagement plays in any observed benefit. We also discuss how to measure programme value realistically and why careful experimental design matters when organizations make investment decisions.