Three Defences Against Phishing, Ranked by Evidence Rather Than Sales Volume

How CodoraTech is funded: CodoraTech is supported by advertising and, in some articles, by affiliate links. Where an article contains affiliate links, we say so at the top of that article.

Ranking anti-phishing measures by the quality of the evidence behind them produces almost the reverse of the order in which they are marketed. The technical control that removes the value of a stolen password has published outcome data from two named organisations and an explicit government recommendation. The reporting channel has independent academic evidence at the scale of a whole company. Simulated phishing with attached training, the largest market of the three by a wide margin, has two large field experiments finding effectively no durable benefit. What follows takes them in evidence order.

Hardware keys: what Google and Cloudflare put on the record

CISA’s October 2022 fact sheet on implementing phishing-resistant multi-factor authentication recognises exactly two forms as phishing-resistant: FIDO and WebAuthn authentication, and public key infrastructure based MFA. Its recommendation is unqualified, urging all organizations to implement phishing-resistant MFA as part of applying Zero Trust principles.

Google made physical security keys mandatory for all employees in early 2017, when it had more than 85,000 of them. In July 2018 a Google spokesperson told Brian Krebs that the company had had no reported or confirmed account takeovers since implementing security keys, and that security keys now form the basis of all account access at Google. Krebs’s own framing keeps the distinction that matters: no reported or confirmed account takeovers is not the same claim as eliminating phishing, and this is Google reporting on Google rather than an audited external finding.

The more instructive record belongs to Cloudflare. On 20 July 2022 more than 76 of its employees received SMS phishing messages, and three of them entered their credentials on the attacker’s page. No systems were breached. FIDO2 hardware keys with origin binding meant the attackers held valid usernames and passwords and, in Cloudflare’s words, could not get past the hard key requirement; even a sophisticated, real-time phishing operation like this cannot gather the information necessary to log in.

That is the honest illustration for an article about awareness. At a security company, staffed by security-aware people, three employees still typed their credentials into a phishing page. Cloudflare characterised the attack as targeting employees and systems in such a way that it believed most organisations would be likely to be breached. Awareness did not prevent the compromise; the token binding contained it. Cloudflare also drew a cultural conclusion worth carrying over, that having a paranoid but blame-free culture is critical for security.

The limit of the control is specific. Keys and passkeys do not abolish phishing, they remove the payoff from credential phishing. They do nothing about malware, about weaker MFA paths left enabled as fallbacks, or about attacks on enrolment and account recovery. Cloudflare’s own account is proof that people still click and still type. CISA’s assessment of the weaker factors organisations tend to deploy instead is worth reproducing:

• SMS and voice codes are vulnerable to phishing, SS7 and SIM swap attacks, and should only be used as a last resort MFA option
• Push notifications without number matching are vulnerable to push bombing attacks as well as user error
• App-based authentication remains vulnerable to phishing attacks
• Organisations should identify systems that do not support MFA and plan either to upgrade them or migrate to systems that do

Reporting: the only effect that held for fifteen months

The ETH Zurich team of Daniele Lain, Kari Kostiainen and Srdjan Capkun found something that held its effect where training did not. Across their fifteen-month IEEE S&P 2022 study of 14,733 employees, the reporting button was used consistently from beginning to end, while training effects were not sustained. The paper claims to be the first demonstration that using the employees as a collective phishing detection mechanism is practical in large organizations, with fast detection of new campaigns and an operational load the organisation could absorb.

Speed is what makes it a control rather than a formality. Roughly a tenth of reports landed inside five minutes, a fifth inside fifteen and between 30 and 40 percent inside half an hour, which is fast enough for a response team to pull a live campaign while it is still running. The UK’s National Cyber Security Centre has shown the same model works at national scale: its Suspicious Email Reporting Service took 7.1 million reports of suspicious emails and URLs during 2022, and nearly 235,000 malicious website links had been removed from the internet since the service opened in April 2020.

Two costs come with it. Reporting is a detection control, not a prevention control: it shortens dwell time and it does not save the first victim. And volume is not free. Cloudflare disclosed that roughly 90 percent of the reports reaching its own security incident response team were false alarms, which is the operational price of asking everyone to report anything.

Simulate-and-train: the biggest market, the thinnest independent evidence

Simulated phishing followed by an immediate training page is the approach most organisations buy first, and it is the one with the least independent support. At UC San Diego Health, Grant Ho and colleagues tracked 19,500 employees through ten campaigns over eight months for IEEE S&P 2025 and measured a reduction of about two percentage points in subsequent clicking from embedded training. Annual mandated awareness training had no significant relationship with susceptibility.

Their engagement data explains the size of that number. About three quarters of employees spent a minute or less on the training page and roughly a third shut it immediately. The ETH Zurich authors reached a compatible verdict from a different workforce, writing that embedded training during simulated phishing exercises, as commonly deployed in the industry today, does not make employees more resilient to phishing.

Every large-scale statistic showing this approach works comes from a company that sells it, measured on that company’s own platform without a control group. Every independent field experiment that established a comparison group found little or no durable effect. Simulations can also cost something: CBS News reported that GoDaddy sent a simulated email in December 2020 promising a 650 dollar holiday bonus, that around 500 employees received it and around 500 clicked, and that the company apologised for an exercise staff found insensitive.

Reading the ranking against the order it is sold in

Set out in the order the published evidence supports rather than the order the market pushes:

1. Phishing-resistant authentication. Published outcomes from two named organisations, Google and Cloudflare, plus an explicit CISA recommendation. Strongest evidence, though both accounts are company-published rather than independently audited.
2. Employee reporting, resourced and acted on. Independent academic evidence of a sustained effect across 14,733 employees and fifteen months, corroborated by national-scale operational data from the NCSC.
3. Simulated phishing with embedded training. The largest market and the weakest independent evidence, with two large field studies finding effectively no durable behavioural benefit.

Sources: CISA, Implementing Phishing-Resistant MFA · Krebs on Security · Cloudflare blog · arXiv (Lain, Kostiainen and Capkun, IEEE S&P 2022) · UC San Diego Today (Ho et al., IEEE S&P 2025)