Tell Me A Story: The Effects That Narratives Exert on Meaningful-Engagement Outcomes in Antiphishing Training

Antiphishing training is a critical element of an organization’s security posture. Yet, its effectiveness is often limited by trainees’ perception that it is boring and unengaging, which weakens their attention and thus diminishes learning outcomes. We examine whether antiphishing training that uses narratives—stories—can make training more engaging and improve training outcomes. To that end, we conduct an experiment to compare the effects of a narrative antiphishing training against an existing non-narrative training as well as a no-training control group. Comparing against the control group, we found both training models to be effective. However, comparing the two training models, the experiment showed that the narrative training engenders higher levels of curiosity among trainees and higher levels of phishing-detection self-efficacy and phishing-detection ability. Taken together, these findings show that antiphishing training in specific, and perhaps security training in general, can be improved using narratives.