Proyecto de Titulación embargado con fines de publicación de impacto.

Abstract

This study analyzed the susceptibility of university students at the Universidad Católica de Cuenca to simulated phishing campaigns developed with and without the assistance of generative AI. A quantitative, applied, and descriptive-comparative study was conducted through four types of controlled campaigns sent to 12,220 students: “Pending Payment AI,” “Pending Payment Without AI,” “Unrecognized Login AI,” and “Unrecognized Login Without AI.” Indicators such as open rate, clicks on sent emails, clicks on opened emails, and reports of the email as suspicious were analyzed. The results showed an overall open rate of 28.13% and an overall click rate on sent emails of 13.87%. Emails written with generative AI recorded a click rate of 16.64%, compared with 11.10% for emails without AI with a risk ratio of 1.50. The “Pending Payment” scenario was the most effective. The findings suggest that generative AI can increase the effectiveness of social engineering attacks in university environments and highlight the need to strengthen training, periodic simulation, and an institutional reporting culture.

Keywords: Generative artificial intelligence; simulated phishing; social engineering; university cybersecurity; student susceptibility; cybersecurity awareness.