The demographic effects of phishing awareness training and AI-based risk analysis: An experimental study on organizational employees

With the increasing complexity of cybersecurity threats, phishing attacks targeting the human factor have become one of the most critical risk factors for organizations. This study evaluates the effectiveness of phishing awareness training among organizational employees by examining demographic variables such as gender, age, educational background, and job position, and performs individual risk estimation using AI-based models. Conducted through an experimental design, the research was carried out on 3721 employees in a public institution. Two-stage phishing simulations based on real-life scenarios were administered to employees before and after the training. The obtained data were analyzed using ID3, K-Nearest Neighbors (KNN), Naive Bayes, and Random Forest algorithms, with the class imbalance problem addressed using the Random Oversampling method. Research findings revealed that, contrary to general expectations, resistance to phishing attacks did not increase with higher education levels; rather, this group remained in the high-risk category due to the "overconfidence" factor. Furthermore, the 18-35 age group, defined as digital natives, was identified as a risk group due to speed-oriented behaviors, whereas employees aged 55 and over demonstrated the highest relative resilience, showing the least increase in susceptibility compared to other age groups despite the general upward trend. Among the AI models, Random Forest and ID3 algorithms demonstrated the highest success in detecting risky profiles. The results indicate that instead of a one-size-fits-all training approach, organizations should develop customized, dynamic, and AI-supported training strategies based on demographic characteristics and behavioral risk profiles.