Phishing is one of the most prolific cybercriminal activities, with attacks becoming increasingly sophisticated. It is, therefore, imperative to explore novel technologies to improve user protection across both technical and human dimensions. Large Language Models (LLMs) offer significant promise for text processing in various domains, but their use for defense against phishing attacks still remains scarcely explored. In this paper, we present APOLLO, a tool based on OpenAI’s GPT-4o to detect phishing emails and generate explanation messages to users about why a specific email is dangerous, thus improving their decision-making capabilities. We have evaluated the performance of APOLLO in classifying phishing emails; the results show that GPT-4o has exemplary capabilities in classifying phishing emails (97% accuracy) and that this performance can be further improved by integrating data from third-party services, resulting in a near-perfect classification rate (99% accuracy). To assess the perception of the explanations generated by this tool, we also conducted a study with 20 participants, comparing four different explanations presented as phishing warnings. We compared the LLM-generated explanations to four baselines: a manually crafted warning, and warnings from Chrome, Firefox, and Edge browsers. The results show that not only the LLM-generated explanations were perceived as high quality, but also that they can be more understandable, interesting, and trustworthy than the baselines. These findings suggest that using LLMs as a defense against phishing is a very promising approach, with APOLLO representing a proof of concept in this research direction.

Phishing represents one of the most spread and effective cyber-attacks of our times. Warning messages are commonly employed in email clients to notify users about the possible danger and let them decide on their own. However, the high success rate of phishing attacks shows that the existing warnings are not yet adequate. This study contributes by proposing two novel warning dialogs for email clients that prevent users from immediately accessing the content of phishing emails. Specifically, the first one alerts the users against the potential scam, and the second one also reports explanations about the possible causes of the scam. A comparative between-subjects experiment with 300 participants has been performed. Results show that the proposed warnings better defend users from phishing emails than the warnings at the state-of-the-art. In addition, explanations resulted useful in preventing users from discarding genuine emails where warnings are displayed incorrectly due to misclassification of the email.

The cybersecurity domain faces a critical disparity between the escalating demand for skilled professionals and the limited talent pool. This gap is primarily driven by the surge in cyberattacks perpetrated by malicious actors seeking financial gain or disruption. These attacks, encompassing tactics like Distributed Denial-of-Service (DDoS) and ransomware, pose significant threats to data security and public safety. To bridge this gap, several challenges must be addressed. We need to prioritize initiatives that enhance people’s awareness and education in cybersecurity. Additionally, exploring innovative training methods and leveraging technology to equip cybersecurity professionals with the necessary skillsets is crucial. Like the last edition, the goal of this workshop remains to empower individuals to make informed decisions regarding cybersecurity education, navigate diverse career paths, and recognize the alignment between their acquired skills and industry demands. These novel educational methodologies will also equip professionals with a deeper understanding of cybersecurity risks and the expertise required to develop robust and secure technological solutions. Thinking about students, teachers, and professionals as the people who need to learn about cybersecurity, the aim of this workshop is to talk about how we can better match the companies’ demand (workplace, recruitment) and supply (qualification, training). We aim to raise awareness among these learners, help identify the crucial skills that are required for their work and encourage a more unified approach to teaching and training in cybersecurity.