Online Security Behaviors as Predictors of Susceptibility to Simulated Phishing Attacks: A Quantitative Study among Computer Studies Students at Quezon City University (International Journal of Latest Technology in Engineering Management & Applied Science, 2026)
This study examined the relationship between online security behaviors and phishing susceptibility among students of Quezon City University using a quantitative descriptive-correlational research design. The study assessed the respondents’ technical verification behavior, visual trust behavior, reporting behavior, and general cybersecurity awareness and practices, while phishing susceptibility was measured through a simulated phishing campaign utilizing the Gophish framework. A total of 100 students equally distributed across the 1st, 2nd, 3rd, and 4th year levels participated in the study through convenience sampling. Data were collected using a structured survey questionnaire and a phishing simulation that measured email opening, link clicking, credential submission, and reporting behavior. Descriptive statistics, weighted mean, Pearson Product-Moment Correlation Coefficient, and One-Way Analysis of Variance (ANOVA) were employed to analyze the gathered data. The findings revealed that respondents generally demonstrated positive online security behaviors and high levels of cybersecurity awareness, particularly in technical verification practices and general cybersecurity awareness and practices. However, the phishing simulation showed that 21.0% of the respondents clicked the phishing link, while 9.0% submitted sensitive information, indicating that phishing susceptibility remained present despite high self-reported awareness levels. Notably, none of the respondents reported the phishing email during the simulation. The ANOVA results further revealed a significant difference in phishing susceptibility across year levels, with 1st Year students demonstrating the highest level of susceptibility compared to other groups. Meanwhile, Pearson r correlation analysis indicated no statistically significant relationship between online security behaviors and phishing susceptibility. The findings suggest the presence of an awareness–behavior gap, wherein students possess theoretical cybersecurity knowledge but may fail to consistently apply such knowledge in realistic phishing situations. The study concludes that cybersecurity awareness alone is insufficient to fully prevent phishing susceptibility and highlights the importance of continuous simulation-based cybersecurity education, phishing detection training, and practical incident reporting activities to strengthen students’ real-world cybersecurity response capabilities.