{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:27:32Z","timestamp":1766442452286,"version":"3.48.0"},"publisher-location":"New York, NY, USA","reference-count":113,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,11,19]]},"DOI":"10.1145\/3719027.3765179","type":"proceedings-article","created":{"date-parts":[[2025,11,22]],"date-time":"2025-11-22T23:37:25Z","timestamp":1763854645000},"page":"51-65","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Quantifying Security Training in Organizations Through the Analysis of U.S. SEC 10-K Filings"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5159-3868","authenticated-orcid":false,"given":"Jonas","family":"Hielscher","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbruecken, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2204-2132","authenticated-orcid":false,"given":"Maximilian","family":"Golla","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbruecken, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,11,22]]},"reference":[{"key":"e_1_3_2_1_1_1","first-page":"4","article-title":"Assessing the Factors of Cybersecurity Awareness in the Banking Sector","volume":"37","author":"Al-Alawi Adel Ismail","year":"2019","unstructured":"Adel Ismail Al-Alawi and Sara Abdulrahman Al-Bassam. 2019. Assessing the Factors of Cybersecurity Awareness in the Banking Sector. Arab Gulf Journal of Scientific Research, Vol. 37, 4 (June 2019), 17-32.","journal-title":"Arab Gulf Journal of Scientific Research"},{"key":"e_1_3_2_1_2_1","first-page":"1","volume-title":"Cybersecurity Risk Management in Small and Medium-Sized Enterprises: A Systematic Review of Recent Evidence. In Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA '20)","author":"Alahmari Abdulmajeed","year":"2020","unstructured":"Abdulmajeed Alahmari and Bob Duncan. 2020. Cybersecurity Risk Management in Small and Medium-Sized Enterprises: A Systematic Review of Recent Evidence. In Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA '20). IEEE, Dublin, Ireland, 1-5."},{"key":"e_1_3_2_1_3_1","unstructured":"American Institute of CPAs. 2011. System and Organization Controls 2 (SOC 2) - Trust Services Criteria for Security Availability Processing Integrity Confidentiality and Privacy. https:\/\/www.aicpa-cima.com\/resources\/landing\/system-and-organization-controls-soc-suite-of-services as of today."},{"key":"e_1_3_2_1_4_1","volume-title":"Security Engineering: A Guide to Building Dependable Distributed Systems (3 ed.)","author":"Anderson Ross","year":"2021","unstructured":"Ross Anderson. 2021. Security Engineering: A Guide to Building Dependable Distributed Systems (3 ed.). Wiley, Hoboken, New Jersey, USA."},{"key":"e_1_3_2_1_5_1","first-page":"1","volume-title":"Measuring the Changing Cost of Cybercrime. In Workshop on the Economics of Information Security (WEIS '19)","author":"Anderson Ross","year":"2019","unstructured":"Ross Anderson, Chris Barton, Rainer B\u00f6hme, Richard Clayton, Carlos Gan\u00e1n, Tom Grasso, Michael Levi, Tyler Moore, and Marie Vasek. 2019. Measuring the Changing Cost of Cybercrime. In Workshop on the Economics of Information Security (WEIS '19). Oxford University Press, Boston, Massachusetts, USA, 1-32."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-39498-0_12"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.1130992"},{"key":"e_1_3_2_1_8_1","first-page":"150","volume-title":"An Empirical Analysis of Enterprise-Wide Mandatory Password Updates. In Annual Conference on Computer Security Applications (ACSAC '23)","author":"Ariana Mirian","year":"2023","unstructured":"Mirian Ariana, Ho Grant, Savage Stefan, and Voelker Geoffrey M., 2023. An Empirical Analysis of Enterprise-Wide Mandatory Password Updates. In Annual Conference on Computer Security Applications (ACSAC '23). ACM, Honolulu, Hawaii, USA, 150-162."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2016.57"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.09.004"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1108\/ICS-07-2018-0080"},{"key":"e_1_3_2_1_12_1","first-page":"118","volume-title":"International Conference on Cyber Security for Sustainable Society (CSSS '15)","author":"Bada Maria","unstructured":"Maria Bada, Angela M. Sasse, and Jason R.C. Nurse. 2015. Cyber Security Awareness Campaigns: Why Do They Fail to Change Behaviour?. In International Conference on Cyber Security for Sustainable Society (CSSS '15). Sustainable Society Network, Coventry, United Kingdom, 118-131."},{"volume-title":"Finding Security Champions in Blends of Organisational Culture. In Workshop on Usable Security and Privacy (USEC '17)","author":"Becker Ingolf","key":"e_1_3_2_1_13_1","unstructured":"Ingolf Becker, Simon Parkin, and M. Angela Sasse. 2017. Finding Security Champions in Blends of Organisational Culture. In Workshop on Usable Security and Privacy (USEC '17). ISOC, San Diego, California, USA."},{"key":"e_1_3_2_1_14_1","first-page":"73","volume-title":"Excuse Makers and Security Champions: Mapping the Risk Perceptions and Emotions That Drive Security Behaviors. In New Security Paradigms Workshop (NSPW '15)","author":"Beris Odette","unstructured":"Odette Beris, Adam Beautement, and M. Angela Sasse. 2015. Employee Rule Breakers, Excuse Makers and Security Champions: Mapping the Risk Perceptions and Emotions That Drive Security Behaviors. In New Security Paradigms Workshop (NSPW '15). ACM, Twente, Netherlands, 73-84."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jaccpubpol.2018.10.003"},{"key":"e_1_3_2_1_16_1","unstructured":"David C. 2022. NCSC Blog: Telling Users to `Avoid Clicking Bad Links' Still Isn't Working. https:\/\/www.ncsc.gov.uk\/blog-post\/telling-users-to-avoid-clicking-bad-links-still-isnt-working as of today."},{"key":"e_1_3_2_1_17_1","unstructured":"California State Legislature. 2018. California Consumer Privacy Act (CCPA) as of today."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10551-022-05107-z"},{"volume-title":"Statistical Power Analysis for the Behavioral Sciences (2 ed.)","author":"Cohen Jacob","key":"e_1_3_2_1_19_1","unstructured":"Jacob Cohen. 1988. Statistical Power Analysis for the Behavioral Sciences (2 ed.). Routledge, New York City, New York, USA."},{"volume-title":"Mathematical Methods of Statistics","author":"Cram\u00e9r Harald","key":"e_1_3_2_1_20_1","unstructured":"Harald Cram\u00e9r. 1946. Mathematical Methods of Statistics. Princeton University Press, Princeton, New Jersey, USA."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3555090"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00019"},{"key":"e_1_3_2_1_23_1","volume-title":"Workshop on Usable Security and Privacy (USEC '22)","author":"Das Sanchari","year":"2022","unstructured":"Sanchari Das and Junibel De La Cruz. 2022. SoK: A Proposal for Incorporating Accessible Gamified Cybersecurity Awareness Training Informed by a Systematic Literature Review. In Workshop on Usable Security and Privacy (USEC '22). ISOC, San Diego, California, USA."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1365\/s43439-024-00129-x"},{"key":"e_1_3_2_1_25_1","unstructured":"European Repository of Cyber Incidents. 2025. EuRepoC: European Repository of Cyber Incidents. https:\/\/eurepoc.eu as of today."},{"key":"e_1_3_2_1_26_1","volume-title":"Symposium on Usable Privacy and Security (SOUPS '20). USENIX, Virtual Conference, 19-35","author":"Farke Florian M.","year":"2020","unstructured":"Florian M. Farke, Lennart Lorenz, Theodor Schnitzler, Philipp Markert, and Markus D\u00fcrmuth. 2020. ''You still use the password after all'' - Exploring FIDO2 Security Keys in a Small Company. In Symposium on Usable Privacy and Security (SOUPS '20). USENIX, Virtual Conference, 19-35."},{"key":"e_1_3_2_1_27_1","unstructured":"Financial Industry Regulatory Authority Inc. 2022. Market Cap Explained. https:\/\/www.finra.org\/investors\/insights\/market-cap as of today."},{"key":"e_1_3_2_1_28_1","first-page":"339","article-title":"SoK: Still Plenty of Phish in the Sea - A Taxonomy of User-Oriented Phishing Interventions and Avenues for Future Research. In Symposium on Usable Privacy and Security (SOUPS '21). USENIX","author":"Franz Anjuli","year":"2021","unstructured":"Anjuli Franz, Verena Zimmermann, Gregor Albrecht, Katrin Hartwig, Christian Reuter, Alexander Benlian, and Joachim Vogt. 2021. SoK: Still Plenty of Phish in the Sea - A Taxonomy of User-Oriented Phishing Interventions and Avenues for Future Research. In Symposium on Usable Privacy and Security (SOUPS '21). USENIX, Virtual Conference, 339-358.","journal-title":"Virtual Conference"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(11)70082-3"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.accinf.2020.100468"},{"key":"e_1_3_2_1_31_1","volume-title":"Symposium on Usable Privacy and Security (SOUPS '21). USENIX, Virtual Conference, 17-36","author":"Gerlitz Eva","year":"2021","unstructured":"Eva Gerlitz, Maximilian H\u00e4ring, and Matthew Smith. 2021. Please do not use !?_ or your License Plate Number: Analyzing Password Policies in German Companies. In Symposium on Usable Privacy and Security (SOUPS '21). USENIX, Virtual Conference, 17-36."},{"key":"e_1_3_2_1_32_1","first-page":"191","volume-title":"Symposium on Usable Privacy and Security (SOUPS '23)","author":"Gerlitz Eva","year":"2023","unstructured":"Eva Gerlitz, Maximilian H\u00e4ring, Matthew Smith, and Christian Tiefenau. 2023. Evolution of Password Expiry in Companies: Measuring the Adoption of Recommendations by the German Federal Office for Information Security. In Symposium on Usable Privacy and Security (SOUPS '23). USENIX, Anaheim, California, USA, 191-210."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1111\/jbfa.12416"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.2307\/25750692"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1001\/jamanetworkopen.2019.0393"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833756"},{"key":"e_1_3_2_1_37_1","volume-title":"Roback","author":"Guttman Barbara","year":"1995","unstructured":"Barbara Guttman and Edward A. Roback. 1995. An Introduction to Computer Security: The NIST Handbook. https:\/\/csrc.nist.gov\/pubs\/sp\/800\/12\/final, as of today."},{"key":"e_1_3_2_1_38_1","first-page":"13","volume-title":"User Behaviors and Attitudes Under Password Expiration Policies. In Symposium on Usable Privacy and Security (SOUPS '18)","author":"Habib Hana","year":"2018","unstructured":"Hana Habib, Pardis Emami Naeini, Summer Devlin, Maggie Oates, Chelse Swoopes, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2018. User Behaviors and Attitudes Under Password Expiration Policies. In Symposium on Usable Privacy and Security (SOUPS '18). USENIX, Baltimore, Maryland, USA, 13-30."},{"key":"e_1_3_2_1_39_1","first-page":"567","volume-title":"Towards Bridging the Research-Practice Gap: Understanding Researcher-Practitioner Interactions and Challenges in Human-Centered Cybersecurity. In Symposium on Usable Privacy and Security (SOUPS '24)","author":"Haney Julie M.","unstructured":"Julie M. Haney, Clyburn Cunningham, and Susanne M. Furman. 2024a. Towards Bridging the Research-Practice Gap: Understanding Researcher-Practitioner Interactions and Challenges in Human-Centered Cybersecurity. In Symposium on Usable Privacy and Security (SOUPS '24). USENIX, Philadelphia, Pennsylvania, USA, 567-586."},{"volume-title":"Towards Integrating Human-Centered Cybersecurity Research Into Practice: A Practitioner Survey. In Workshop on Usable Security and Privacy (USEC '24)","author":"Haney Julie M.","key":"e_1_3_2_1_40_1","unstructured":"Julie M. Haney, Clyburn Cunningham, and Susanne M. Furman. 2024b. Towards Integrating Human-Centered Cybersecurity Research Into Practice: A Practitioner Survey. In Workshop on Usable Security and Privacy (USEC '24). ISOC, San Diego, California, USA."},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"crossref","unstructured":"Julie M. Haney Jody Jacobs Susanne M. Furman and Fernando Barrientos. 2022. Approaches and Challenges of Federal Cybersecurity Awareness Programs. Technical Report NISTIR 8420A. National Institute of Standards and Technology.","DOI":"10.6028\/NIST.IR.8420B"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2020.3001959"},{"key":"e_1_3_2_1_43_1","first-page":"2","article-title":"From Compliance to Impact: Tracing the Transformation of an Organisational Security Awareness Programme","volume":"8","author":"Haney Julie M.","year":"2024","unstructured":"Julie M. Haney and Wayne Lutters. 2024. From Compliance to Impact: Tracing the Transformation of an Organisational Security Awareness Programme. Cyber Security: A Peer-Reviewed Journal, Vol. 8, 2 (Oct. 2024), 110-130.","journal-title":"Cyber Security: A Peer-Reviewed Journal"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2841113.2841122"},{"key":"e_1_3_2_1_45_1","first-page":"99","volume-title":"IEEE Symposium on Security and Privacy (SP '17)","author":"Herley Cormac","unstructured":"Cormac Herley and P.C. Van Oorschot. 2017. SoK: Science, Security and the Elusive Goal of Security as a Scientific Pursuit. In IEEE Symposium on Security and Privacy (SP '17). IEEE, San Jose, California, USA, 99-120."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","unstructured":"Jonas Hielscher and Maximilian Golla. 2025. Replication Package: ''Quantifying Security Training in Organizations Through the Analysis of U.S. SEC 10-K Filings''. https:\/\/doi.org\/10.6084\/m9.figshare.28789001 as of today.","DOI":"10.6084\/m9.figshare.28789001"},{"key":"e_1_3_2_1_47_1","first-page":"2311","volume-title":"USENIX Security Symposium (SSYM '23)","author":"Hielscher Jonas","unstructured":"Jonas Hielscher, Uta Menges, Simon Parkin, Annette Kluge, and M. Angela Sasse. 2023. ''Employees Who Don't Accept the Time Security Takes Are Not Aware Enough'': The CISO View of Human-Centred Security. In USENIX Security Symposium (SSYM '23). USENIX, Anaheim, California, USA, 2311-2328."},{"key":"e_1_3_2_1_48_1","first-page":"3295","volume-title":"USENIX Security Symposium (SSYM '24)","author":"Hielscher Jonas","year":"2024","unstructured":"Jonas Hielscher and Simon Parkin. 2024. ''What Keeps People Secure Is That They Met the Security Team'': Deconstructing Drivers and Goals of Organizational Security Awareness. In USENIX Security Symposium (SSYM '24). USENIX, Philadelphia, Pennsylvania, USA, 3295-3312."},{"key":"e_1_3_2_1_49_1","first-page":"2666","volume-title":"Selling Satisfaction: A Qualitative Analysis of Cybersecurity Awareness Vendors' Promises. In ACM Conference on Computer and Communications Security (CCS '24)","author":"Hielscher Jonas","year":"2024","unstructured":"Jonas Hielscher, Markus Sch\u00f6ps, Jens Opdenbusch, Felix Reichmann, Marco Gutfleisch, Karola Marky, and Simon Parkin. 2024. Selling Satisfaction: A Qualitative Analysis of Cybersecurity Awareness Vendors' Promises. In ACM Conference on Computer and Communications Security (CCS '24). ACM, Salt Lake City, Utah, USA, 2666-2680."},{"key":"e_1_3_2_1_50_1","unstructured":"Annette Hillebrand Antonia Niederpr\u00fcm Saskja Sch\u00e4fer and Sonja Thiele. 2018. Current IT Security Situation in SME: Summary of Representative Survey Results. https:\/\/www.wik.org\/veroeffentlichungen\/veroeffentlichung\/aktuelle-lage-der-it-sicherheit-in-kmu as of today."},{"key":"e_1_3_2_1_51_1","first-page":"1","volume-title":"Understanding the Efficacy of Phishing Training in Practice. In IEEE Symposium on Security and Privacy (SP '25)","author":"Ho Grant","unstructured":"Grant Ho, Ariana Mirian, Elisa Luo, Khang Tong, Euyhyun Lee, Lin Liu, Christopher A. Longhorst, Christian Dameff, Stefan Savage, and Geoffrey M. Voelker. 2025. Understanding the Efficacy of Phishing Training in Practice. In IEEE Symposium on Security and Privacy (SP '25). IEEE, San Jose, California, USA, 1-18."},{"key":"e_1_3_2_1_52_1","first-page":"207","article-title":"Datasets for Analysis of Cybercrime (1 ed.). Springer, Cham, Switzerland","volume":"10","author":"Jordan Howell MC.","year":"2020","unstructured":"MC. Jordan Howell and George W. Burruss. 2020. Datasets for Analysis of Cybercrime (1 ed.). Springer, Cham, Switzerland, Chapter 10, 207-219.","journal-title":"Chapter"},{"key":"e_1_3_2_1_53_1","volume-title":"USENIX Security Symposium (SSYM '21). USENIX, Virtual Conference, 1235-1252","author":"Huaman Nicolas","year":"2021","unstructured":"Nicolas Huaman, Bennet von Skarczinski, Christian Stransky, Dominik Wermke, Yasemin Acar, Arne Drei\u00dfigacker, and Sascha Fahl. 2021. A Large-Scale Interview Study on Information Security in and Attacks against Small and Medium-sized Enterprises. In USENIX Security Symposium (SSYM '21). USENIX, Virtual Conference, 1235-1252."},{"key":"e_1_3_2_1_54_1","first-page":"383","volume-title":"The True Cost of Unusable Password Policies: Password Use in the Wild. In ACM Conference on Human Factors in Computing Systems (CHI '10)","author":"Inglesant Philip G.","unstructured":"Philip G. Inglesant and M. Angela Sasse. 2010. The True Cost of Unusable Password Policies: Password Use in the Wild. In ACM Conference on Human Factors in Computing Systems (CHI '10). ACM, Atlanta, Georgia, USA, 383-392."},{"key":"e_1_3_2_1_55_1","first-page":"2016","article-title":"ISO\/IEC 27001 Information Technology - Security Techniques - Information Security Management Systems - Requirements","volume":"29110","author":"International Organization for Standardization.","year":"2022","unstructured":"International Organization for Standardization. 2022. ISO\/IEC 27001 Information Technology - Security Techniques - Information Security Management Systems - Requirements. Standard ISO\/IEC TR 29110-1:2016. International Organization for Standardization, Geneva, Switzerland.","journal-title":"Standard ISO\/IEC TR"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2007.25"},{"key":"e_1_3_2_1_57_1","first-page":"102267","article-title":"Enhancing Employees Information Security Awareness in Private and Public Organisations","volume":"106","author":"Khando Khando","year":"2021","unstructured":"Khando Khando, Shang Gao, Sirajul M Islam, and Ali Salman. 2021. Enhancing Employees Information Security Awareness in Private and Public Organisations: A Systematic Literature Review. Computers & Security, Vol. 106, 102267 (July 2021), 1-22.","journal-title":"A Systematic Literature Review. Computers & Security"},{"key":"e_1_3_2_1_58_1","volume-title":"Decoding Complexity: Exploring Human-AI Concordance in Qualitative Coding. CoRR","author":"Kirsten Elisabeth","year":"2024","unstructured":"Elisabeth Kirsten, Annalina Buckmann, Abraham Mhaidli, and Steffen Becker. 2024. Decoding Complexity: Exploring Human-AI Concordance in Qualitative Coding. CoRR, Vol. abs\/2403.06607 (March 2024), 1-6."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1111\/1911-3846.12735"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/3274361"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/1978942.1979321"},{"volume-title":"Practice, Implementation with Software and Artificial Intelligence (German Version) (6 ed.). Beltz Juventa","author":"Kuckartz Udo","key":"e_1_3_2_1_62_1","unstructured":"Udo Kuckartz and Stefan R\u00e4diker. 2024. Qualitative Content Analysis: Methods, Practice, Implementation with Software and Artificial Intelligence (German Version) (6 ed.). Beltz Juventa, Weinheim, Germany."},{"key":"e_1_3_2_1_63_1","first-page":"4182","volume-title":"Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training. In ACM Conference on Computer and Communications Security (CCS '24)","author":"Lain Daniele","year":"2024","unstructured":"Daniele Lain, Tarek Jost, Sinisa Matetic, Kari Kostiainen, and Srdjan Capkun. 2024. Content, Nudges and Incentives: A Study on the Effectiveness and Perception of Embedded Phishing Training. In ACM Conference on Computer and Communications Security (CCS '24). ACM, Salt Lake City, Utah, USA, 4182-4196."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833766"},{"key":"e_1_3_2_1_65_1","first-page":"7231","volume-title":"USENIX Security Symposium (SSYM '24)","author":"Lassak Leona","year":"2024","unstructured":"Leona Lassak, Elleen Pan, Blase Ur, and Maximilian Golla. 2024. Why Aren't We Using Passkeys? Obstacles Companies Face Deploying FIDO2 Passwordless Authentication. In USENIX Security Symposium (SSYM '24). USENIX, Philadelphia, Pennsylvania, USA, 7231-7248."},{"key":"e_1_3_2_1_66_1","volume-title":"Jinjuan Heidi Feng, and Harry Hochheiser","author":"Lazar Jonathan","year":"2017","unstructured":"Jonathan Lazar, Jinjuan Heidi Feng, and Harry Hochheiser. 2017. Research Methods in Human Computer Interaction (2 ed.). Morgan Kaufmann, Cambridge, Massachusetts, USA."},{"key":"e_1_3_2_1_67_1","unstructured":"Matt Linton. 2024. Google Security - On Fire Drills and Phishing Tests. https:\/\/security.googleblog.com\/2024\/05\/on-fire-drills-and-phishing-tests.html as of today."},{"key":"e_1_3_2_1_68_1","first-page":"1","volume-title":"International Conference on Information Systems (ICIS '22)","author":"Lowry Michelle Ren\u00e9","year":"2022","unstructured":"Michelle Ren\u00e9 Lowry, Zeynep Sahin, and Anthony Vance. 2022. Taking a Seat at the Table: The Quest for CISO Legitimacy. In International Conference on Information Systems (ICIS '22). AIS, Copenhagen, Denmark, 1-14."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3027321"},{"key":"e_1_3_2_1_70_1","first-page":"237","volume-title":"European Workshop on Usable Security (EuroUSEC '23)","author":"Menges Uta","unstructured":"Uta Menges, Jonas Hielscher, Laura Kocksch, Annette Kluge, and M. Angela Sasse. 2023. Caring Not Scaring - An Evaluation of a Workshop to Train Apprentices as Security Champions. In European Workshop on Usable Security (EuroUSEC '23). ACM, New York, NY, USA, 237-252."},{"key":"e_1_3_2_1_71_1","first-page":"1","article-title":"The Role of the Chief Information Security Officer (CISO) in Organizations. In Confer\u00eancia da Associa\u00e7 ao Portuguesa de Sistemas de Informa\u00e7 ao (CAPSI '19). APSI, Lisbon","author":"Monzelo Pedro","year":"2019","unstructured":"Pedro Monzelo and Sergio Nunes. 2019. The Role of the Chief Information Security Officer (CISO) in Organizations. In Confer\u00eancia da Associa\u00e7 ao Portuguesa de Sistemas de Informa\u00e7 ao (CAPSI '19). APSI, Lisbon, Portugal, 1-14.","journal-title":"Portugal"},{"key":"e_1_3_2_1_72_1","volume-title":"Phishing Attacks: Defending Your Organisation. https:\/\/www.ncsc.gov.uk\/guidance\/phishing, as of today.","author":"National Cyber Security Centre.","year":"2024","unstructured":"National Cyber Security Centre. 2024. Phishing Attacks: Defending Your Organisation. https:\/\/www.ncsc.gov.uk\/guidance\/phishing, as of today."},{"key":"e_1_3_2_1_73_1","first-page":"5127","volume-title":"USENIX Security Symposium (SSYM '23)","author":"Nisenoff Alexandra","year":"2023","unstructured":"Alexandra Nisenoff, Maximilian Golla, Miranda Wei, Juliette Hainline, Hayley Szymanek, Annika Braun, Annika Hildebrandt, Blair Christensen, David Langenberg, and Blase Ur. 2023. A Two-Decade Retrospective Analysis of a University's Vulnerability to Attacks Exploiting Reused Passwords. In USENIX Security Symposium (SSYM '23). USENIX, Anaheim, California, USA, 5127-5144."},{"key":"e_1_3_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240595"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","unstructured":"Cherilyn Pascoe Stephen Quinn and Karen Scarfone. 2024. The NIST Cybersecurity Framework (CSF) 2.0. https:\/\/doi.org\/10.6028\/NIST.CSWP.29 as of today.","DOI":"10.6028\/NIST.CSWP.29"},{"key":"e_1_3_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103699"},{"key":"e_1_3_2_1_77_1","unstructured":"Agnieszka Pawlowska and Benedikt Scherer. 2021. German BSI: IT Security While Working from Home in 2020 (German Version). https:\/\/www.bsi.bund.de\/SharedDocs\/Downloads\/DE\/BSI\/Publikationen\/Lageberichte\/Umfrage-Home-Office\/umfrage_home-office-2020.pdf as of today."},{"key":"e_1_3_2_1_78_1","volume-title":"Symposium on Usable Privacy and Security (SOUPS '20). USENIX, Virtual Conference, 259-284","author":"Reinheimer Benjamin","year":"2020","unstructured":"Benjamin Reinheimer, Lukas Aldag, Peter Mayer, Mattia Mossano, Reyhan Duezguen, Bettina Lofthouse, Tatiana Von Landesberger, and Melanie Volkamer. 2020. An Investigation of Phishing Awareness and Education Over Time: When and How to Best Remind Users. In Symposium on Usable Privacy and Security (SOUPS '20). USENIX, Virtual Conference, 259-284."},{"key":"e_1_3_2_1_79_1","first-page":"1","volume-title":"Digital Health","volume":"8","author":"Rizzoni Fabio","year":"2022","unstructured":"Fabio Rizzoni, Sabina Magalini, Alessandra Casaroli, Pasquale Mari, Matt Dixon, and Lynne Coventry. 2022. Phishing Simulation Exercise in a Large Hospital: A Case Study. Digital Health, Vol. 8 (March 2022), 1-13."},{"key":"e_1_3_2_1_80_1","first-page":"2","article-title":"Examining the Costs and Causes of Cyber Incidents","volume":"2","author":"Romanosky Sasha","year":"2016","unstructured":"Sasha Romanosky. 2016. Examining the Costs and Causes of Cyber Incidents. Journal of Cybersecurity, Vol. 2, 2 (Dec. 2016), 121-135.","journal-title":"Journal of Cybersecurity"},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690212"},{"key":"e_1_3_2_1_82_1","first-page":"4589","volume-title":"Stress and Self-Efficacy. In USENIX Security Symposium (SSYM '24)","author":"Sch\u00f6ps Markus","unstructured":"Markus Sch\u00f6ps, Marco Gutfleisch, Eric Wolter, and M. Angela Sasse. 2024. Simulated Stress: A Case Study of the Effects of a Simulated Phishing Campaign on Employees' Perception, Stress and Self-Efficacy. In USENIX Security Symposium (SSYM '24). USENIX, Philadelphia, Pennsylvania, USA, 4589-4606."},{"key":"e_1_3_2_1_83_1","unstructured":"Shobhit Seth Gordon Scott and Suzanne Kvilhaug. 2024. Market Capitalization Sizes. https:\/\/www.investopedia.com\/investing\/market-capitalization-defined\/ as of today."},{"key":"e_1_3_2_1_84_1","first-page":"151","volume-title":"International Conference on Advanced Science and Engineering (ICOASE '20)","author":"Karzan","unstructured":"Karzan H. Sharif and Siddeeq Y. Ameen. 2020. A Review of Security Awareness Approaches with Special Emphasis on Gamification. In International Conference on Advanced Science and Engineering (ICOASE '20). IEEE, Duhok, Iraq, 151-156."},{"key":"e_1_3_2_1_85_1","volume-title":"Exploring the Evolving Balance of Power Between CISOs and CIOs: A Qualitative Perspective. In Americas Conference on Information Systems (AMCIS '24)","author":"Singh Raghvendra","year":"2024","unstructured":"Raghvendra Singh, Pavankumar Mulgund, and Sanjukta Das Smith. 2024. Exploring the Evolving Balance of Power Between CISOs and CIOs: A Qualitative Perspective. In Americas Conference on Information Systems (AMCIS '24). AIS, Salt Lake City, Utah, USA."},{"key":"e_1_3_2_1_86_1","unstructured":"Rob Sloan. 2024. S&P 500 Proxy Statements: What Companies Disclose About Their Cybersecurity Programs. https:\/\/www.zscaler.com\/resources\/industry-reports\/sp-500-cyberssecurity-risk-management.pdf as of today."},{"key":"e_1_3_2_1_87_1","first-page":"3583","volume-title":"USENIX Security Symposium (SSYM '23)","author":"Stegman Jonah","year":"2023","unstructured":"Jonah Stegman, Patrick J. Trottier, Caroline Hillier, Hassan Khan, and Mohammad Mannan. 2023. ''My Privacy for Their Security'': Employees' Privacy Perspectives and Expectations When Using Enterprise Security Software. In USENIX Security Symposium (SSYM '23). USENIX, Anaheim, California, USA, 3583-3600."},{"key":"e_1_3_2_1_88_1","unstructured":"ThriveDX. 2022. Cybersecurity Awareness Training Study. https:\/\/web.archive.org\/web\/20230104143405\/https:\/\/2714581.fs1.hubspotusercontent-na1.net\/hubfs\/2714581\/TDX%20Downloads\/2022-TDX-Cybersecurity-Awareness-Training-Study-Final%201.pdf as of today."},{"key":"e_1_3_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW51379.2020.00064"},{"key":"e_1_3_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102387"},{"key":"e_1_3_2_1_91_1","unstructured":"U.S. Department of Homeland Security. 2012. The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research. https:\/\/www.caida.org\/publications\/papers\/2012\/menlo_report_actual_formatted\/ as of today."},{"key":"e_1_3_2_1_92_1","unstructured":"U.S. Securities and Exchange Commission. 1941. Regulation N-5B-1: \u00a7270.5b-1 Definition of ''Total Assets''. https:\/\/www.law.cornell.edu\/cfr\/text\/17\/270.5b-1 as of today."},{"key":"e_1_3_2_1_93_1","unstructured":"U.S. Securities and Exchange Commission. 2023a. Public Company Cybersecurity Disclosures: Final Rules. https:\/\/www.sec.gov\/files\/33-11216-fact-sheet.pdf as of today."},{"key":"e_1_3_2_1_94_1","unstructured":"U.S. Securities and Exchange Commission. 2023b. SEC Adopts Rules on Cybersecurity Risk Management Strategy Governance and Incident Disclosure by Public Companies. https:\/\/www.sec.gov\/files\/rules\/final\/2023\/33-11216.pdf as of today."},{"key":"e_1_3_2_1_95_1","unstructured":"U.S. Securities and Exchange Commission. 2024a. Developer Resources. https:\/\/www.sec.gov\/about\/developer-resources as of today."},{"key":"e_1_3_2_1_96_1","unstructured":"U.S. Securities and Exchange Commission. 2024b. Exchange Act Reporting and Registration. https:\/\/www.sec.gov\/resources-small-businesses\/going-public\/exchange-act-reporting-registration as of today."},{"key":"e_1_3_2_1_97_1","unstructured":"U.S. Securities and Exchange Commission. 2024c. The Electronic Data Gathering Analysis and Retrieval (EDGAR) System. https:\/\/www.sec.gov\/edgar\/searchedgar\/companysearch.html as of today."},{"key":"e_1_3_2_1_98_1","unstructured":"U.S. Securities and Exchange Commission. 2024d. Webmaster Frequently Asked Questions. https:\/\/www.sec.gov\/about\/webmaster-frequently-asked-questions as of today."},{"key":"e_1_3_2_1_99_1","unstructured":"U.S. Securities and Exchange Commission. 2025a. How to Read a 10-K. https:\/\/www.sec.gov\/answers\/reada10k.htm as of today."},{"key":"e_1_3_2_1_100_1","unstructured":"U.S. Securities and Exchange Commission. 2025b. Standard Industrial Classification (SIC) Code List. https:\/\/www.sec.gov\/search-filings\/standard-industrial-classification-sic-code-list as of today."},{"key":"e_1_3_2_1_101_1","unstructured":"VERBI GmbH. 2023. MAXQDA 24: Software for Qualitative Data Analysis. https:\/\/www.maxqda.com as of today."},{"key":"e_1_3_2_1_102_1","volume-title":"MAXQDA: Code Matrix Browser - Visualizing Codes Per Document. https:\/\/www.maxqda.com\/help-mx24\/visual-tools\/code-matrix-browser-visualizing-codes-per-document, as of today.","author":"VERBI","year":"2025","unstructured":"VERBI GmbH. 2025a. MAXQDA: Code Matrix Browser - Visualizing Codes Per Document. https:\/\/www.maxqda.com\/help-mx24\/visual-tools\/code-matrix-browser-visualizing-codes-per-document, as of today."},{"key":"e_1_3_2_1_103_1","volume-title":"MAXQDA: Global Text Search. https:\/\/www.maxqda.com\/help-mx24\/text-search\/global-text-search, as of today.","author":"VERBI","year":"2025","unstructured":"VERBI GmbH. 2025b. MAXQDA: Global Text Search. https:\/\/www.maxqda.com\/help-mx24\/text-search\/global-text-search, as of today."},{"key":"e_1_3_2_1_104_1","unstructured":"Verified Market Research. 2024. Global Security Awareness Training Software Market Size. https:\/\/www.verifiedmarketresearch.com\/product\/security-awareness-training-software-market\/ as of today."},{"key":"e_1_3_2_1_105_1","first-page":"312","volume-title":"Analysing Simulated Phishing Campaigns for Staff. In European Symposium on Research in Computer Security (ESORICS '20)","author":"Volkamer Melanie","year":"2020","unstructured":"Melanie Volkamer, Martina Angela Sasse, and Franziska Boehm. 2020. Analysing Simulated Phishing Campaigns for Staff. In European Symposium on Research in Computer Security (ESORICS '20). Springer, Guildford, United Kingdom, 312-328."},{"key":"e_1_3_2_1_106_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigDataSecurity62737.2024.00013"},{"key":"e_1_3_2_1_107_1","first-page":"9","article-title":"You Cannot Spell Risk Without ''I-S'': The Disclosure of Information Systems Risks by Fortune 1000 Firms","volume":"2024","author":"Whitaker Jonathan","year":"2024","unstructured":"Jonathan Whitaker and Shital Thekdi. 2024. You Cannot Spell Risk Without ''I-S'': The Disclosure of Information Systems Risks by Fortune 1000 Firms. Risk Analysis, Vol. 2024, 9 (Sept. 2024), 1-17.","journal-title":"Risk Analysis"},{"key":"e_1_3_2_1_108_1","first-page":"1","volume-title":"International Journal of Human-Computer Studies","volume":"120","author":"Williams Emma J.","year":"2018","unstructured":"Emma J. Williams, Joanne Hinds, and Adam N. Joinson. 2018. Exploring Susceptibility to Phishing in the Workplace. International Journal of Human-Computer Studies, Vol. 120 (Dec. 2018), 1-13."},{"key":"e_1_3_2_1_109_1","volume-title":"USENIX Security Symposium (SSYM '21). USENIX, Virtual Conference, 1199-1216","author":"Wolf Flynn","year":"2021","unstructured":"Flynn Wolf, Adam J. Aviv, and Ravi Kuber. 2021. Security Obstacles and Motivations for Small Businesses from a CISO's Perspective. In USENIX Security Symposium (SSYM '21). USENIX, Virtual Conference, 1199-1216."},{"key":"e_1_3_2_1_110_1","first-page":"1","article-title":"Privacy Legislation as Business Risks: How GDPR and CCPA are Represented in Technology Companies' Investment Risk Disclosures. In ACM Conference on Computer-Supported Cooperative Work and Social Computing (CSCW '23). ACM, Minneapolis","volume":"82","author":"Wong Richmond Y.","year":"2023","unstructured":"Richmond Y. Wong, Andrew Chong, and R. Cooper Aspegren. 2023. Privacy Legislation as Business Risks: How GDPR and CCPA are Represented in Technology Companies' Investment Risk Disclosures. In ACM Conference on Computer-Supported Cooperative Work and Social Computing (CSCW '23). ACM, Minneapolis, Minnesota, USA, 82:1-82:26.","journal-title":"Minnesota, USA"},{"key":"e_1_3_2_1_111_1","volume-title":"Woods and Rainer B\u00f6hme","author":"Daniel","year":"2021","unstructured":"Daniel W. Woods and Rainer B\u00f6hme. 2021. How Cyber Insurance Shapes Incident Response: A Mixed Methods Study. In Workshop on the Economics of Information Security (WEIS '21). Oxford University Press, Virtual Conference, 1-35."},{"key":"e_1_3_2_1_112_1","unstructured":"XBRL International. 2003. Extensible Business Reporting Language (XBRL) 2.1 Specification. https:\/\/specifications.xbrl.org\/xbrl-essentials.html as of today."},{"key":"e_1_3_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijhcs.2019.05.005"}],"event":{"name":"CCS '25: ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Taipei Taiwan","acronym":"CCS '25"},"container-title":["Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3719027.3765179","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T22:25:27Z","timestamp":1766442327000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3719027.3765179"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,19]]},"references-count":113,"alternative-id":["10.1145\/3719027.3765179","10.1145\/3719027"],"URL":"https:\/\/doi.org\/10.1145\/3719027.3765179","relation":{},"subject":[],"published":{"date-parts":[[2025,11,19]]},"assertion":[{"value":"2025-11-22","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}