Phishing Freakonomics

In this presentation at the DEF CON 27 Packet Hacking Village, Russell Butturini applies principles of behavioral economics and cognitive psychology to dissect modern corporate phishing awareness simulations. He challenges standard industry metrics at 09:00, asserting that raw click rates are deeply misleading indicators of organizational vulnerability because employee performance varies drastically depending on operational context, workload, and personal stress levels.

Russell tracks phishing simulation outcomes across calendar quarters at 18:00, showing statistically significant spikes in click-through rates during high-stress corporate events such as year-end financial reporting and holiday seasons. At 27:00, he delivers a sharp critique of punitive security policies, demonstrating how disciplinary action and public shaming create an adversarial culture where workers actively conceal security mistakes rather than reporting them.

Advocating for constructive behavioral reinforcement at 36:00, Russell outlines strategies for lightweight, continuous security coaching that rewards vigilance instead of penalizing errors. At 45:00, he details how shifting the focus toward frictionless incident reporting resulted in higher employee engagement and faster threat detection across enterprise endpoints. He concludes at 54:00 by discussing simulation design, template customization, and building empathy between security teams and general staff. (AI summary — Gemini Flash)