So they grabbed some sample email formulations from phishing attacks of the past and sent them to specific email addresses.
Some of these phishing emails had links, others didn't.
Would they be blocked? Would they at least be marked as suspicious?
Would fish make excellent world leaders?
The results were truly painful. A fulsome 75% of the linkless messages wafted straight through to inboxes. A hearty 64% of the ones enjoying links also sailed in without so much as a passport check.
Professor Steven Furnell, the Center's leader, offered a dim view of email providers.
He said: "The poor performance of most providers implies they either do not employ filtering based on language content or that it is inadequate to protect users. Given users' tendency to perform poorly at identifying malicious messages, this is a worrying outcome."
Equally, technology struggles to notice that a message reading: "My dear, your inheritance is to arriving here fast and soon. Please allow remittance details" isn't likely to come from anyone who is actually related to you, knows you or would even ever want to send you money.
Could it be, perhaps, that many of the largest email providers just don't care?
After all, have you ever tried to get any sort of customer service from most of them? I tried with Microsoft once and was offered lots of unhelpful pre-prepared FAQs and a complete inability to contact an actual human being.
As my colleague Danny Palmer recently reported, the most common form of phishing threat in your inbox is the personal impersonation.
Of course, users should have become more adept at noticing when an email is an evil fake.
You might think, though, that tech companies would have used their sophisticated systems to learn the clumsy wordings of so many of these scammers and made sure that none of these fakes ever reaches their customers' eyes.
After all, I actually pay Microsoft for my Hotmail, yet many of the phishing emails don't even get labeled as junk.