  Organizations rely on phishing interventions to enhance employees' vigilance
and safe responses to phishing emails that bypass technical solutions. While
various resources are available to counteract phishing, studies emphasize the
need for interactive and practical training approaches. To investigate the
effectiveness of such an approach, we developed and delivered two anti-phishing
trainings, group discussion and role-playing, at a European university. We
conducted a pre-registered experiment (N = 105), incorporating repeated
measures at three time points, a control group, and three in-situ phishing
tests. Both trainings enhanced employees' anti-phishing self-efficacy and
support-seeking intention in within-group analyses. Only the role-playing
training significantly improved support-seeking intention when compared to the
control group. Participants in both trainings reported more phishing tests and
demonstrated heightened vigilance to phishing attacks compared to the control
group. We discuss practical implications for evaluating and improving phishing
interventions and promoting safe responses to phishing threats within
organizations.
