While phishing has evolved over the years, it still exploits one of the weakest links in any information system — humans. The present study aims at describing who the potential phishing victims are. We constructed two types of phishing messages that represented two basic categories of phishing e-mails: regular and spear-phishing. In cooperation with the IT management of a municipality in the southwestern region of the United States, we sent these messages to the municipality’s employees and collected demographic data about individuals employed by the organization. We then applied eight supervised learning methods to classify the municipality’s employees into two groups: phished and not-phished. Our results indicate that spear-phishing yields a significantly higher response rate than regular phishing and that some machine learning methods yield high classification accuracy in predicting phishing victims. We finally provide discussion of the results as well as the future implications.

Although multiple security applications (apps) are offered by third-party developers for free, only a small portion of smart device users have adopted these apps. The lack of relevant research urgently requires an in-depth investigation of influential factors of the user's adoption of the new cyber security countermeasures. In this study, we introduce a theoretical model by integrating factors from the user's awareness perspective and the user's trust perspective. We find that the user's technology awareness and trust in security apps both have significant positive effects on their adoption intention. The user's trust in security apps also has a significant moderating effect on the relationship between their threat awareness and their adoption intention. These findings do not only provide a theoretical foundation for future mobile security app adoption research, but also offer several implications for developers to push the diffusion of their software in the promising app based cyber security market.