The Prescribed Attack: Teaching Security Through Controlled Failure

Organizations deliberately send millions of fake phishing emails to test their own employees—a practice grounded in the principle that the only way to build strength is to constantly test it. But the industry numbers don't match the academic reality. We explore the science of inoculation theory, the metaphor of prescribed burns, which training actually works, and where this methodology transforms other fields entirely. 00:00:00 - The Deliberate Deception: Why Companies Test Their People 00:03:21 - Inoculation Theory and Structural Pattern 00:11:24 - Embedded Training: The Real Impact 00:14:45 - Beyond Email: Texts, Calls, QR Codes 00:16:24 - Measured Results vs. Vendor Claims --- Sources & further reading: • Grant Ho et al. — "Understanding the Efficacy of Phishing Training in Practice" (IEEE S&P 2025): https://people.cs.uchicago.edu/~grantho/papers/oakland2025_phishing-training.pdf • Ferro et al. — "Sustaining Cyber Awareness: The Long-Term Impact of Continuous Phishing Training and Emotional Triggers" (arXiv, 2025): https://arxiv.org/html/2510.27298 • William J. McGuire — "The Effectiveness of Supportive and Refutational Defenses in Immunizing and Restoring Beliefs Against Persuasion" (Sociometry, 1961) — (original journal article) • KnowBe4 — "Q4 2025 Phishing Trends Report" (2026): https://www.knowbe4.com/press/knowbe4-releases-q4-2025-phishing-trends-report-highlighting-the-power-of-personalized-attacks • Rozema et al. — "Does Phishing Training Work? A Large-Scale Empirical Assessment" (SOUPS 2025): https://roze.ma/wp-content/uploads/2025/03/Rozema_SOUPS_25__Phish_Scale-.pdf • NEAIS 2025 — "When Training Backfires: A Behavioral Perspective on the Negative Effects of Phishing Simulation": https://aisel.aisnet.org/neais2025/23/ • Verizon — "2025 Data Breach Investigations Report" — (annual industry report) • Replication of McGuire (2024) — "Sixty Years Later: A Replication Study of McGuire's First Inoculation Experiment" (Journal of Media Psychology): https://econtent.hogrefe.com/doi/abs/10.1027/1864-1105/a000396 • Biddlestone et al. — "Tune in to the prebunking network! Development and validation of six inoculation videos" (Political Psychology, 2025): https://onlinelibrary.wiley.com/doi/full/10.1111/pops.70015 • arXiv — "Shots and Boosters: Exploring the Use of Combined Prebunking Interventions" (2025): https://arxiv.org/pdf/2505.07486 • Stanford Woods Institute — "Study shows controlled burns can reduce wildfire intensity and smoke pollution": https://woods.stanford.edu/news/study-shows-controlled-burns-can-reduce-wildfire-intensity-and-smoke-pollution • Team Rubicon — "Wildfire Mitigation Strategies Return to Their Roots": https://teamrubiconusa.org/news-and-stories/wildfire-mitigation-strategies-return-to-their-roots/ • RAND Corporation — "Wargaming: The Surprisingly Effective Tool That Can Help Us Prepare for Modern Crises" (Nov 2025): https://www.rand.org/pubs/commentary/2025/11/wargaming-the-surprisingly-effective-tool-that-can.html • FDIC Working Paper — "Stress Testing Banks: Whence and Whither?": https://www.fdic.gov/system/files/2024-07/2015-07.pdf • Bank for International Settlements — "The future of stress testing and the stress capital buffer" (2024): https://www.bis.org/review/r240911b.pdf • PhishGun — "Phishing Click Rate Benchmarks 2026": https://phishgun.com/blog/phishing-click-rate-benchmarks • StationX — "Phishing Statistics 2026": https://app.stationx.net/articles/phishing-statistics This podcast episode was fully generated by AI — research, script, voices, and production. Built with Claude, Piper TTS, and automated pipeline tooling.