dee informative (expository) summary

1

Annotated Bibliography

 Topic: The Impact of Cybersecurity Awareness Training on Phishing Attacks in Healthcare Organizations

Ladetra Gibbs

Purdue University Global

October 4 2026

 Topic: The Impact of Cybersecurity Awareness Training on Phishing Attacks in Healthcare Organizations

Annotated Bibliography

Carreiro, A., Silva, C., & Antunes, M. (2024). The use of gamification on cybersecurity awareness of healthcare professionals. Procedia Computer Science, 239, 526–533. https://doi.org/10.1016/j.procs.2024.06.202

This article summarizes (1) the basics of gamification and (2) the potential for its use to enhance cybersecurity awareness in the healthcare industry. The authors point out that digital literacy training is an area that is not highly prevalent among health care professionals, and that human error contributes to many data breaches. They believe that traditional training does not maintain motivation and long-term learning. Gamification, using game elements in learning, is introduced as a solution to boost participation and allow the learners to work at their own pace. The paper is divided into three parts: the first section outlines the existing gamified methods, the second examines the recent literature about gamification and cybersecurity training and the third is a discussion on how to implement these methods in cybersecurity training courses for healthcare employees.

Financed by an internal research competition at the Polytechnic Institute of Lisbon, the work is hosted by the repository of the Polytechnic Institute of Lisbon and is therefore peer reviewed. May be available in a conference proceedings series published by Elsevier, which may have lighter reviews than a traditional journal. The text of the abstract is well structured. It is a literature review and does not provide any quantifiable results from phishing experiments and provides a broad overview of cyber security awareness and not just phishing awareness. It's up to date for 2024.

Challacombe, D. J., & McElhiney, E. N. (2025). Phishing susceptibility among healthcare workers: The impact of awareness, email type, and location. International Journal of Advanced Corporate Learning, 18(1), 4–15. https://doi.org/10.3991/ijac.v18i1.51671

The purpose of this study was to determine whether or not anti-phishing awareness training decreased the susceptibility of healthcare workers to simulated phishing e-mail messages. In three experiments, conducted over 18 months, the researchers used various awareness campaigns, simulated content for the email, and remote versus on-site workers. Participants were workers from a private health information firm. Those given anti-phishing awareness interacted with the fake email fewer times than those who were not given anti-phishing awareness. In each experiment, approximately four percent of workers applied on the bogus site. The authors found that some benefits can be gained from any type of anti-phishing training.

Both the author and editor are employees of Verisma Systems and Fort Hays State University. It is published in International Journal of Advanced Corporate Learning (IJACL), an open access journal, screened for plagiarism in EBSCO and dblp databases. The abstract is well organized and brief. The results may not be applied to clinical staff as participants were working for a health information company. It is very current, and will be published in 2025.

Nelson, N. (2025, July 1). We’ve all been wrong: Phishing training doesn’t work. Dark Reading. https://www.darkreading.com/endpoint-security/phishing-training-doesnt-work

This article describes a comprehensive, long-term training of phishing at UC San Diego Health program involving 19,789 individuals over eight months in 2023. The researchers compared annual awareness training with four types of embedded training that are offered post-employee fall for a simulated phish. Interactive training was found to yield the best result, and the participants were approximately 19 percent less likely to click on subsequent phishing links than were those who received static training. No long-term effects on clicking were seen after annual training. Even the most well-trained employees were fooled by highly convincing e-mail messages over 15 percent of the time.

Nate Nelson is a journalist with degrees from New York University and Bard College, previously worked for Threatpost and helped create cybersecurity-related podcasts. He's not a researcher, so the piece relies on a conversation with study co-author Ariana Mirian. Dark Reading is Informa TechTarget's established trade publication, which runs advertising. The writing is well organized with headings and clear. It is credible because it has links to the original IEEE proceedings. It is expected to be published in July 2025.

Rizzoni, F., Magalini, S., Casaroli, A., Mari, P., Dixon, M., & Coventry, L. (2022). Phishing simulation exercise in a large hospital: A case study. Digital Health, 8, Article 20552076221081716. https://doi.org/10.1177/20552076221081716

This case study is about a phishing simulation, which is a component of the annual training and risk assessment carried out at a large hospital in Italy where over 6,000 health care workers are employed. Three campaigns were initiated approximately four months apart for comparison of responses to a generic phishing e-mail and a customized phishing e-mail. The 64 percent of staff who didn't open the general message in the first campaign was compared to 38 percent who didn't open the customized message. The campaigns were, however, hindered due to issues raised within the organisation, and could not be conducted as planned. The authors find that simulations are helpful but have limitations.

The authors are psychologists who have received funding from the hospital and a UK research council; corresponding author Lynne Coventry is a psychologist who has received funding from the hospital. This article has been peer-reviewed and published free of charge in Digital Health via PubMed Central. It is easy to follow and its structured abstract and cited literature. The findings are limited as it applies to one hospital and campaigns that were interrupted. It was published in March 2022, it is in the five-year window and is the oldest source.