## 2 Related Works
[PERSON] and [PERSON] [10] examined simulation data from a technical university and noted heightened vulnerability during academic intervals. [PERSON] et al. [11] investigated the influence of various phishing email content types on behavior through two simulation rounds within a railway organization, emphasizing that the framing and familiarity of the content significantly affected user responses. [PERSON] et al. [12] asserted that behavior-based controls, including recurrent training and observation, proved more efficacious than performance-based metrics in diminishing phishing success rates. Phishing resistance is often viewed as a function of end-user attentiveness; nevertheless, new studies increasingly ascribe success rates to the growing sophistication of attacker methodologies. [PERSON] et al. [13] delineate the progression of phishing from basic mass email initiatives to modern, AI-enhanced, context-aware assaults. Their findings highlight the growing impact of phishing-as-a-service (PhaaS) platforms and machine learning algorithms that can generate misleading content tailored to specific corporate contexts. [PERSON] et al. [14] further illustrate that phishing emails generated by large language models far exceed traditional spam in provoking user engagement, primarily due to their human-like linguistic composition and ability to circumvent rule-based filtering systems. [PERSON] et al. [15] empirically validate this transition, demonstrating that completely automated spear-phishing tactics produced by generative models can achieve or surpass a 50% click-through rate, competing with carefully constructed human efforts. In a similar vein, [PERSON] et al. [16] introduce the Phishing Evolution Network (PEN), a dynamic adversarial architecture that utilizes massive language models to develop innovative phishing variants continually. This method not only enhances realism and message variety but also enables attackers to circumvent static detection systems, thereby diminishing the effectiveness of conventional rule-based defenses. Cross-cultural and sector-specific research further substantiates the intricacy of phishing defense. [PERSON] et al. [17] conducted phishing simulations in Saudi Arabia, highlighting the importance of iterative testing cycles and debriefings. [PERSON] et al. [18] documented findings from a nationwide exercise in Thailand's financial sector, indicating that although numerous users disregarded phishing attempts, a substantial fraction still engaged with harmful links. These findings underscore the global significance of phishing threats and the varying levels of preparedness among sectors. The psychological and cognitive aspects of phishing have been examined. [PERSON] et al. [19] found that the perceived severity of threats and the efficacy of responses were crucial in predicting whether employees reported or engaged with phishing emails. [PERSON] et al. [20] conducted an extensive user survey revealing that most participants had previously experienced phishing and demonstrated a desire for additional education, indicating a growing demand for training and awareness that has not yet been effectively addressed. [PERSON] and [PERSON] [21] employed a cognitive simulation model to forecast phishing responses, demonstrating that variables such as memory recency and similarity affect user behavior, indicating that susceptibility to phishing is both situational and psychologically structured. To mitigate variability in individual risk, [PERSON] [22] introduced a Cyber Risk Index (CRI) that operates similarly to a credit score, allowing organizations to distribute training and administrative privileges based on a user's risk profile. This tailored methodology diverges from conventional role-based access, providing a means to synchronize cybersecurity strategy with behavioral data. [PERSON] et al. [23] adopted an innovative approach by developing a game that enables users to design and execute phishing attacks, thereby enhancing their comprehension of attacker strategies and vulnerabilities.