Why does security awareness training fail?
Security awareness training fails when it changes what employees know without changing what they do. The common failure pattern: identical annual content for every employee, measured by completion rather than behavior, delivered months away from the moment of risk. Attackers exploit psychology - urgency, authority, curiosity - under time pressure, and a remembered slide rarely beats a well-crafted trigger in the moment.
Also known as: awareness training failure · phishing training does not work · security training effectiveness · training fatigue
The three structural failures
First, uniformity: the same course treats the accountant who fails every urgency-based phish and the engineer who never clicks identically, wasting attention where it is not needed and under-serving where it is. Second, timing: training happens on the compliance calendar, but attacks happen on the attacker’s - the lesson and the moment of risk rarely meet. Third, measurement: completion rates and quiz scores are attendance metrics, and boards routinely mistake them for risk reduction.
What works instead
Programs that move click rates share three traits: personalization (simulations tuned by machine learning to each person’s susceptibility profile), immediacy (coaching delivered at the moment of the failure or risky action, not the next quarter), and reinforcement of the right behavior (making it effortless and rewarded to report). This is the design behind Dcoya’s Behave, Bewise and Beware - and the measurable baseline it produces is what lets a CISO show the program working.
In the Cyberdis portfolio
Dcoya fixes the failure modes of awareness training - distributed by Cyberdis.
FAQ
Common questions.
Our completion rate is 98% but people still click - is that normal?
Common enough to be the category’s defining problem: completion measures attention, not resistance. The fix is measuring behavior directly through personalized simulation, then training against each person’s actual weaknesses.
Do phishing simulations create a culture of distrust?
Badly designed ones can - public shaming and gotcha templates backfire. Well-designed programs keep results private, pair failure with short supportive coaching, and celebrate reporting; the culture effect then runs positive.
How fast can behavior actually change?
Cohort click rates typically move within the first few personalized campaign cycles, and report rates rise even faster once reporting is one click. A Cyberdis pilot with Dcoya establishes the baseline in the first campaign, so improvement is visible from cycle two.
Related explainers: What is human risk management?What is security awareness training?What is business email compromise (BEC)?
Weighing approaches? Personalized behavioral training vs annual awareness training: what actually changes behavior?