Featured publication
What makes people susceptible to phishing attacks: A systematic literature review and future research agenda
Mark Spicer and Jason RC Nurse
Published in Computers & Security, 2026, Elsevier.
Despite significant advances in both cybersecurity technology and anti-phishing research, phishing remains the most common cause of breaches. This Systematic Literature Review synthesises existing evidence on why people fall for phishing emails, examining the individual and environmental factors associated with phishing susceptibility and the effectiveness of organisational controls. Following the PRISMA methodology, 4402 articles were identified, of which 54 met the inclusion criteria and formed the basis of analysis. This review makes three contributions. First, it produces a systematic evidence verdict on each factor associated with phishing susceptibility, separating those with strong consensus support from those that are contested, robust nulls, or supported by only thin evidence. Second, it develops a conceptual framework integrating individual factors, environmental factors and the intention-behaviour gap as three contributors to the decision process. Third, it identifies a structural mismatch between current organisational controls, which predominantly target individual knowledge through awareness training and the multi-factor structure of susceptibility, which requires intervention across all three contributors. Practical implications for organisational cybersecurity practice and a research agenda spanning empirical, ethical and AI-enabled-phishing dimensions are developed. It also confirms the need for more large-scale research in a real-world environment to understand individual and environmental factors that cause people to be susceptible to phishing emails.