Most security awareness programs consist of an annual online training module and some posters near the printer. Research consistently shows these interventions have minimal effect on staff behaviour. Here's what the evidence says actually changes how people respond to cyber threats.
The human element is involved in over 80% of data breaches, according to Verizon's annual DBIR. Phishing, social engineering, stolen credentials, misdirected emails — all require a human action somewhere in the chain. The logical response is training people not to make those mistakes. The problem is that the training most organisations deliver doesn't work.
Why Annual Training Modules Fail
The typical security awareness program: staff complete a 30-minute online module once a year, click through a quiz, receive a completion certificate. This approach has three fundamental problems.
Spacing: Learning research consistently shows that knowledge retained from a single training session decays rapidly without reinforcement. Information absorbed in January is largely forgotten by July. Annual training produces an annual peak of security awareness followed by eleven months of decay.
Context: Generic training scenarios — "What should you do if you receive a suspicious email?" — don't transfer well to real situations. Real phishing emails are personalised, topical, and don't come with a "This might be suspicious" warning label. Training that feels realistic produces better behavioural transfer than generic scenarios.
Relevance: Staff who can't see a connection between the training content and their actual work day tune out. A warehouse manager doing a module about SQL injection attacks is not going to retain useful security behaviour from that experience.
What the Evidence Says Works
Simulated phishing with immediate feedback: The most effective security awareness intervention is a simulated phishing email sent to staff from your IT team or awareness training platform. When a staff member clicks the link, instead of a malicious page, they receive an immediate, brief explanation of the indicators they missed and what they should have done. This just-in-time training, in the exact context of the real threat, produces significantly better retention than classroom training.
High frequency, short duration: Monthly simulated phishing campaigns with brief weekly micro-learning (two to three minutes, not 30 minutes) outperform annual long-form training on every measured outcome — click rates, reporting rates, and sustained knowledge retention. The key is making security part of the regular rhythm of work rather than an annual compliance checkbox.
Positive reinforcement for reporting: Staff who report suspicious emails should be thanked and acknowledged — even (especially) when the email turns out to be legitimate. A culture where reporting is rewarded catches real threats faster. A culture where false reports are treated as a nuisance produces staff who don't report.
Measuring What Matters
The metric that matters in a security awareness program is not completion rate. It's the simulated phishing click rate over time — specifically whether it's decreasing — and the reporting rate (what percentage of simulated phishing emails are reported to IT rather than ignored or clicked). Optimyze includes simulated phishing campaigns as part of the managed IT security service for clients who want a measurable behavioural security programme.
Annual compliance training doesn't change behaviour. Realistic, frequent, contextual practice — with immediate feedback — does. The goal of security awareness isn't completing a module; it's changing what people do when they see a real threat.
