Phishing remains a persistent cybersecurity threat; however, developing scalable and effective user training is labor-intensive and challenging to maintain. Generative Artificial Intelligence offers an interesting opportunity, but empirical evidence on its instructional efficacy remains scarce. This paper provides an experimental validation of Large Language Models (LLMs) as autonomous engines for generating phishing resilience training. Across two controlled studies (N=480), we demonstrate that AI-generated content yields significant pre-post learning gains regardless of the specific prompting strategy employed. Study 1 (N=80) compares four prompting techniques, finding that even a straightforward "direct-profile" strategy--simply embedding user traits into the prompt--produces effective training material. Study 2 (N=400) investigates the scalability of this approach by testing personalization and training duration. Results show that complex psychometric personalization offers no measurable advantage over well-designed generic content, while longer training duration provides a modest boost in accuracy. These findings suggest that organizations can leverage LLMs to generate high-quality, effective training at scale without the need for complex user profiling, relying instead on the inherent capabilities of the model.

翻译：网络钓鱼攻击仍是网络安全领域的持续性威胁，然而开发可扩展且有效的用户培训方案通常需要大量人力且难以长期维护。生成式人工智能为此提供了新的可能性，但其在教学效果方面的实证依据仍显不足。本文通过实验验证了大型语言模型作为生成网络钓鱼防御训练内容的自主引擎的有效性。通过两项对照研究（总样本量N=480），我们证明无论采用何种具体提示策略，AI生成的内容均能产生显著的前后测学习增益。研究一（N=80）比较了四种提示技术，发现即使是简单的“直接特征描述”策略——仅将用户特征嵌入提示语中——也能生成有效的训练材料。研究二（N=400）通过测试个性化程度与训练时长探究了该方法的可扩展性。结果表明，复杂的心理测量个性化方案并未比精心设计的通用内容产生可衡量的优势，而延长训练时长则能小幅提升识别准确率。这些发现表明，组织可利用大型语言模型规模化生成高质量、高效率的训练内容，无需依赖复杂的用户画像技术，仅需充分发挥模型的内在能力即可。