dee week 10

7

7

Reducing Phishing Risks Through Cybersecurity Awareness Training

Ladetra Gibbs

Purdue University Global

October 16, 2026

Abstract

Famous war general Sun Tzu once stated that knowing your enemy is crucial in handing them a defeat. This is why, to address phishing in healthcare, the field needs to introduce lessons on cybersecurity awareness. This will ensure that it is able to identify threats and address them before they become a serious problem. Ongoing training is crucial to increasing the effectiveness of training in reducing the risk associated with the phenomenon. However, this endeavor is not devoid of challenges, which include a lack of employee participation, support from senior management, and a lack of realistic simulations. However, this does not negate the need for training in achieving reduced phishing risks in the field.

Reducing Phishing Risks Through Cybersecurity Awareness Training

Contemporary society is defined by technology. Almost every facet of our lives requires technology to function. With the use of this technology comes malicious parties who try to leverage technology to cause harm and create avenues of gain from this harm. This is especially true in healthcare, where patient information is akin to digital gold and can be of great benefit to these malicious actors. Employees in the field are now great targets for phishing attacks, where malicious parties utilize deceptive messages through media such as social media and emails that contain links that grant access to them. This opens the door for malicious parties to access healthcare data and use it to the harm of the owners of the data. This is why cybersecurity awareness is vital. It helps to equip healthcare employees with ways to best avoid phishing attacks. The analysis of how cybersecurity awareness training impacts the success of phishing attacks targeting employees in healthcare organizations will be discussed in detail.

Phishing Threats in Healthcare Organizations

There are a myriad of ways phishing is often used by malicious parties. The first is the use of deceptive emails and links. This is where a person receives an email that has seductive messaging to manipulate them into clicking a particular link (Challacombe & McElhiney, 2025). Another is that they speak to the person and convince them to share passwords or sensitive information. The reason they are targeted is that the staff have access to this information and use technology to do so (Rizzoni et al., 2022).

The potential consequences of successful phishing attacks are often harmful. The first is that parties without authorization gain access to patient data. With this data, they can sell it to parties who wish to take control of people's identities (Challacombe & McElhiney, 2025). The confidential information has several uses in the dark areas of technology, which they can use for criminal activities. Phishing attacks can also disrupt healthcare operations and make providing care difficult as the team tries to fix the issue, which could lead to the stalling of crucial technology that healthcare workers rely on (Rizzoni et al., 2022).

Cybersecurity Awareness Training

Purpose of Employee Cybersecurity Training

The aim of this training is to teach employees how phishing scams work and how they can avoid being victims of them. The employees will possess knowledge of how to identify suspicious messages and report them to the IT department so that they can be addressed (Carreiro et al., 2024). The employees can also be taught how best to safely handle potentially successful phishing attempts, along with reinforcing the need for employees to take ownership of the cybersecurity needs of the organization.

Impact of Training on Employee Behavior

The intended impact of this endeavor is to equip the trainees to make better decisions when they encounter phishing attempts (Challacombe & McElhiney, 2025). This includes how to detect them and handle them. With knowledge of the harm that phishing has, the employees will be better equipped to report cybersecurity threats, and this will result in the reduction of risky employee behaviors such as accessing malicious sites that harvest data such as email and answering emails from unknown and untrustworthy senders (Challacombe & McElhiney, 2025).

Factors Affecting Training Effectiveness

One of the major factors affecting the training’s effectiveness is the frequency and consistency of training. Healthcare is notorious for being understaffed, which means that many of its employees are overworked and do not have time for extracurriculars, no matter how crucial they may be (Carreiro et al., 2024). This could affect the consistency of the training. This could also affect engagement from employees, as they could be too exhausted to even care about the training.

Another challenge is the difficulty in simulating phishing. There could be a lack of resources for this endeavor, as funding for many healthcare activities is often very scarce (Nelson, 2025). This could be tied to another potential challenge, which is the lack of support from the leadership with regard to funding and continued support after the initial training (Challacombe & McElhiney, 2025).

Challenges and Limitations

One of the challenges associated with this endeavor is employees becoming less attentive to training. The nature of training is often repetitive, and this can result in them becoming bored or struggling to focus. These employees are also very overworked, and fatigue could also contribute to this phenomenon (Carreiro et al., 2024). In addition, there are also differences in the level of knowledge. Some employees could be very aware of cybersecurity threats, while others could lack any knowledge of them. This could affect classes, as the knowledgeable group could take over the discussion and hinder learning for the rest (Carreiro et al., 2024).

There is also the challenge of constantly changing phishing techniques. Technology is constantly evolving, and new techniques are emerging every day, with the most recent one being the use of AI and its various tools to further convince the victim during an attack. This could mean that what is being trained is rendered irrelevant after a few months (Nelson, 2025). There is also the challenge of eliminating human error, as humans are prone to err and there is a chance this can be exploited by malicious parties.

Improving Cybersecurity Awareness in Healthcare

To aptly address the challenge of phishing, there needs to be an overhaul in how training is done. For one, there is the need for ongoing training rather than it being one-time. This will allow for stakeholders in healthcare to be aware of the many new technologies that could be used to harm them through phishing (Carreiro et al., 2024). There also needs to be training based on realism. Theory must meet practice, with feedback being given by both trainers and trainees. Overall, the field needs to shift from blaming employees in a phishing attack toward appreciating reported cases of phishing when they happen.

Conclusion

Knowledge is power. There is power that comes when employees are aware of the dangers that come with phishing and all it entails. The benefits of knowing about phishing can help prevent instances of the phenomenon happening (Challacombe & McElhiney, 2025). However, with technology constantly evolving, it is vital that healthcare invests in continuous training to increase employee awareness of new threats and to allow them to achieve the field’s broader organizational cybersecurity practices.

References

Carreiro, A., Silva, C., & Antunes, M. (2024). The use of gamification on cybersecurity awareness of healthcare professionals. Procedia Computer Science, 239, 526–533. https://doi.org/10.1016/j.procs.2024.06.202

Challacombe, D. J., & McElhiney, E. N. (2025). Phishing susceptibility among healthcare workers: The impact of awareness, email type, and location. International Journal of Advanced Corporate Learning, 18(1), 4–15. https://doi.org/10.3991/ijac.v18i1.51671

Nelson, N. (2025, July 1). We’ve all been wrong: Phishing training doesn’t work. Dark Reading. https://www.darkreading.com/endpoint-security/phishing-training-doesnt-work

Rizzoni, F., Magalini, S., Casaroli, A., Mari, P., Dixon, M., & Coventry, L. (2022). Phishing simulation exercise in a large hospital: A case study. Digital Health, 8, Article 20552076221081716. https://doi.org/10.1177/20552076221081716

Assignment Instructions

Choose a different technology topic than the one you wrote about for Unit 8. Aim for a topic you are less familiar with, so it will be easier to research and write about, and it might introduce you to concepts you may learn in future classes or in the workplace. If you are unsure whether your topic is appropriate, email your instructor early in the unit for guidance.

Before You Begin: Make sure you have read the Unit 10 Reading PDF and keep the two APA 7th Edition PDFs handy. You may like to refer back to those documents as part of the proofreading process.

Requirements

Your client is a CEO and not a technology expert. Your task is to write a report on your chosen topic and present it in a report format for the company's customers, plus write a business letter to the company CEO to introduce the report to them.

Research required:

· Content sources:

· The report must have three to four sources. Do not use less than three or more than four sources.

· At least two of these sources must be a journal article or ebook chapter available in the online Library but not a "starter" or encyclopedia entry. If you choose an ebook, you will find referencing/citation information in the appropriate TakeAway PDF.

· Any web sources used must either have human authorship and a publication date or be a governmental website.

· Do not reuse any sources from previous assignments.

· As usual, ask your instructor early in the unit if you need assistance or have questions about your source choices.

· Image source:

· Find exactly one suitable image to include in your report. Choose from these options:

· A screenshot of something on your computer relevant to the topic. Visit https://www.take-a-screenshot.org if you need information about doing this. Do not take a screenshot of a copyrighted image, however.

· A photograph you have taken that is relevant to the topic. Again, do not take a picture of a copyrighted image.

· A copyright-free image relevant to the topic. These might be found at Wikimedia Commons, Pixabay, Pexels, FreeImages, and other such repositories online. Important: Always read the licensing agreement. The image you choose must be identified as completely cost-free and available for personal or commercial use. Even when the site license or Creative Commons license does not require attribution, you will need to provide the full URL leading to the original page with the image in your report.

· Do not use AI to create imagery. The reason for this is explained in the reading PDF.

· Business-style Word template:

· Find or create a business-like template.

· Templates must be 8.5” x 11" portrait-oriented Word documents. Look for simple "report" style documents where pages after the cover do not have sidebars, text boxes, or multiple columns. You may use one of the templates found here if you wish: https://fudgelink.com/gen/templates.html

· Do not use your employer's templates or logos. These are proprietary and should never be used for non-work documentation, even if you receive permission.

· Any imagery on the cover should be appropriate to technology or generic (such as shapes).

· The report's pages must have a white background for readability.

The Report

· Content:

· Write to  provide information, not to give instructions or make recommendations. Consider compare/contrast, cause-and-effect, or description as your approach. More about this is explained in the reading PDF.

· The body of the report must be  400–500 words. This does not include the cover page content or reference entries.

· You may include a maximum of 1 short quote (fewer than 40 words). If you decide to quote, ensure proper formatting according to APA 7th edition standards, as previously learned. Quoting is optional.

· Your work must be presented in essay/paragraph form, without lists or tables.

· Remember to cite your sources in the body of the report; lack of citation is a form of academic misconduct

· Document construction:

· The cover page must have the following:

· A descriptive title in title case

· Prepared for: [invent a client name]

· By: [insert your first and last names]

· Date: [insert the date the document was prepared]

· Whatever imagery is in the original template should remain. Do not place your additional image on the cover (see below).

· Do not include a table of contents; this report is not long enough to benefit from it.

· The content of your report must start on the second page.

· On page 2, insert the image you made or found per the instructions below.

· For subheadings, use Introduction, one or two descriptive subheadings, and  Conclusion.

· Note: The use of "Introduction" as a heading is allowed, since these documents are not APA-formatted.

· Do not add second-level or paragraph-inserted subheadings beyond the requirement above.

· After the conclusion, add one more subheading: References. Under this, place your APA reference entries.

· You may single-space the entries, keeping all lines left-aligned, and placing a blank line between them (like the body paragraphs), or you use the hanging indent and single-space.

· This section may immediately follow the conclusion rather than being on a separate page. In the workplace, the cost of printing extra pages when not necessary must be considered.

· Additional formatting requirements:

· For paragraphs, use business-style "block" formatting by applying single-spacing and inserting a blank line between paragraphs. Do not indent the first line of paragraphs. Use left-alignment, not "justified" line formatting, and keep paragraph text black.

· Subheadings may be formatted in whatever manner you like. Color is allowed, but make sure the colors are not so light as to cause readability issues.

· Do not place text in text boxes.

· Headers and footers are allowed but not required. If you use a header, do not make it look like a school paper.

· Use a readable font of your choice, but avoid overly "fancy" fonts and ensure that text size is reasonable for easy reading.

· Image formatting:

· The image you made or found and placed on page 2 must have text wrapped to one side. Click here for special instructions on inserting, resizing, and cropping images, and how to wrap text to the side of an image: Image Handling in Word

· Either directly under the image or in the References section, include the full URL leading directly to the image. If you created it yourself, include this information instead. Full APA referencing is not necessary for the image. 

Introductory Letter:

· Format this in the block letter format explained in the reading PDF. Start with a new document, even if you created this kind of document for other classes. Make sure you include all parts.

· Use your own name, but you may make up an address and phone number for yourself in the letter if you do not wish to share your real address.

· Use your actual Purdue University Global email address, however.

· Use the same CEO name that appears in the report. Invent a company name and use this for the company's address: 1000 E. Main, Springfield, PG 00000

· Between the salutation and closure line, write  180–200 words to introduce the report to the CEO. While some first-person writing would be logical in this kind of document, the focus should be on the topic and how it benefits the CEO's company to know the information in the report. Close the body of the letter with an invitation to discuss further or contact information.

For all parts of this assignment:

· Your writing must follow the rules for formal writing style.

· Remember to use deductive paragraphing (main idea and then details).

· Concepts for the lay reader may need to be simplified; be careful with use of jargon and difficult terminology.

· First-person writing:

· In the report, do not use any first person (I, me, my, myself, we, us, or our).

· In the business letter, first-person writing is to be expected but should be limited, since the focus is on the report's value.

· Do not use wording that may be considered emotional.

· Do not include any code, mathematical formulas, or images beyond what is required.

· Use of AI for any part of this assignment is inappropriate and considered an academic violation.