Despite widespread awareness of risks, significant investments in cybersecurity protection, and substantial economic incentives to avoid security breaches, organizations remain vulnerable to phishing attacks. Phishing research has informed effective practical interventions to address phishing susceptibility that emphasize the importance of broadly applicable IT security knowledge. Yet employees still frequently fall victim to phishing attempts. To help understand why, we conceptualize phishing susceptibility as the failure to differentiate between deceptive and legitimate information processing requests that occur within the context of an employee’s typical job responsibilities. We apply this contextual lens to identify characteristics of knowledge workers’ organizational task and social context that may enhance or diminish performance in detecting deception in phishing email attempts. To test our hypotheses, we conducted a study in which employees of the finance division of a large university encountered simulated email-based phishing attempts as part of their normal work routine. We found evidence supporting our hypotheses that an individual’s susceptibility to phishing attacks is influenced by their position in the knowledge flows of the organization and by the impact of workgroup responsibilities on their cognitive processing. We contend that phishing susceptibility is not merely a matter of IT security knowledge but is also influenced by contextualized, multilevel influences on information processing. As phishing attacks are increasingly targeted to specific organizational settings, it is even more important to incorporate this contextualized information processing view of phishing susceptibility.

中文翻译：

---

上下文中的网络钓鱼易感性：欺骗检测的多级信息处理视角

尽管人们普遍意识到风险，对网络安全保护进行了大量投资，并且为避免安全漏洞提供了大量经济激励，但组织仍然容易受到网络钓鱼攻击。网络钓鱼研究为解决网络钓鱼易感性提供了有效的实际干预措施，强调了广泛适用的 IT 安全知识的重要性。然而，员工仍然经常成为网络钓鱼企图的受害者。为了帮助理解原因，我们将网络钓鱼敏感性概念化为未能区分在员工典型工作职责范围内发生的欺骗性和合法信息处理请求。我们应用此上下文镜头来识别知识工作者的组织任务和社会背景的特征，这些特征可能会增强或削弱检测网络钓鱼电子邮件企图中的欺骗行为的性能。为了检验我们的假设，我们进行了一项研究，其中一所大型大学的财务部门的员工在他们的日常工作中遇到了模拟的基于电子邮件的网络钓鱼尝试。我们发现证据支持我们的假设，即个人对网络钓鱼攻击的敏感性受其在组织知识流中的位置以及工作组责任对其认知处理的影响。我们认为网络钓鱼的易感性不仅仅是 IT 安全知识的问题，而且还受到信息处理的上下文化、多层次影响的影响。