Most security awareness training doesn’t work. People watch a 20-minute video once a year, click through some quizzes, and forget all of it by the next morning. The compliance checkbox gets ticked. The phishing simulation still catches half the company.
If training is going to matter, it has to be designed differently.
Why the annual model fails
It’s too long, too generic, and too far apart. By the time people see the next training, they’ve had 364 days of habit formation in the opposite direction. The video covers everything from password hygiene to physical security to social engineering, and people remember none of it.
The other problem: most training is built like a course. Cybersecurity isn’t a course. It’s a set of judgment calls people make dozens of times a day. Click or don’t. Trust or verify. Share or hold back. The training has to build those instincts.
What actually works
Short, frequent, specific. Five-minute monthly modules beat 90-minute annual training every time. Each module covers one thing. This month: how to spot phishing emails that use AI-generated content. Next month: what to do if you accidentally clicked a link.
Phishing simulations that get gradually harder. Start with obvious ones. Move to targeted, context-aware ones. The point isn’t to embarrass people who click — it’s to teach them what the next round of attacks looks like. The data from each simulation tells you who needs more help and where the curriculum has gaps.
Real examples. People remember stories. “Last quarter, an SMB in our industry lost $300K to a deepfake CEO scam — here’s how it played out” is more memorable than a generic warning about voice cloning.
Role-specific content. The finance team needs different training from the engineering team. The execs need different training from the customer service reps. Generic training is generic because it has to apply to everyone — and ends up applying meaningfully to no one.
Positive reinforcement. Most programs only flag mistakes. The ones that work also recognize good catches. Someone reports a real phishing email? Mention it. People who feel like reporting matters report more.
What to measure
Click rates on phishing simulations, trending over time. Report rates — how often real suspicious emails get flagged by employees. Time-to-report — how fast people raise the flag when they see something.
Don’t measure completion rates as if they mean something. Everyone completes the training. That’s not the goal.
The cultural piece
Awareness training is part of something bigger: a security culture. That’s harder to build but matters more. Culture means people feel comfortable raising concerns, slowing down on suspicious requests, asking questions when something feels off. It means leadership models the behavior — the CEO doesn’t get exempt from the phishing simulation.
This is one of the most underrated parts of broader cybersecurity services programs. Tools matter. Process matters. But people are still where most attacks succeed or fail.
One last thing
Training isn’t a project. It’s a program. The companies whose phish-prone rate drops and stays dropped didn’t run a campaign. They built a rhythm. Monthly content, regular simulations, ongoing reinforcement, leadership engagement. Boring on paper. Effective in practice.
Defensible builds awareness programs that move the needle on real human risk. Talk to an expert.
