Because awareness decays when it is delivered as a one-off event instead of a continuous control. Users need repeated exposure, feedback, and reinforcement before risky behaviour changes in a durable way. In identity terms, the important measure is whether people stop making trust decisions that expose credentials, consent, or sessions, not whether they completed a course.
Why awareness programmes often fail to move behaviour fast enough
Phishing susceptibility stays high because awareness changes knowledge faster than habit. People may learn the warning signs, but under workload pressure they still default to speed, familiarity, and trust cues. That means early programme success often shows up in quiz scores or attendance, while the real control objective, fewer unsafe trust decisions, improves much more slowly.
The gap is usually behavioural, not informational. A one-time briefing can raise caution for a short period, but durable change depends on repeated exposure to realistic scenarios, timely feedback after mistakes, and reinforcement that becomes part of the working rhythm rather than a side activity.
What actually changes when awareness starts working
Effective programmes change how employees respond to specific trust decisions: whether to click, whether to approve a consent prompt, whether to enter credentials, and whether to reuse a session or token path that should have been challenged. That is why phishing remains a live identity problem even when training exists, because the attacker is trying to trigger a fast human decision that bypasses technical controls.
This is also why measurement matters. If the organisation only tracks course completion, it may miss the real exposure: repeated submission of credentials, approval of suspicious prompts, or poor escalation behaviour when a message looks plausible. The control improves when training, simulation, and reporting are tied to the exact actions that create account takeover risk.
Why the environment keeps re-arming the attacker
Phishing succeeds when the environment keeps making trust decisions cheap for attackers and costly for users. Attackers can iterate quickly, personalise lures, and reuse the same delivery paths until someone slips. Internal incidents also show the same pattern across Mailchimp breach 2022 and Dropbox GitHub breach 2022, where social engineering turned human trust into downstream access and secret exposure.
Once a phished account or approval path exists, the problem expands beyond the original message. Stolen credentials, sessions, or consent grants can be reused to reach mailboxes, code repositories, cloud consoles, or support tools, which is why awareness must be paired with friction, verification, and privilege reduction. A programme that does not narrow the blast radius will often underperform even if users become more suspicious.
Risk and Threat Considerations
Phishing remains attractive because it targets the shortest path to access: a human decision that can reveal a password, approve a login, or authorise an OAuth consent flow. When awareness is weak, delayed, or poorly reinforced, attackers gain a repeatable way to turn ordinary communication into account compromise, token theft, or lateral movement.
Failure mechanism: Users recognise the theory of phishing but do not internalise the behaviour under time pressure, so they continue to trust familiar-looking messages, links, or prompts.
Impact: The result is persistent exposure to credential theft, session compromise, and unsafe approval actions, with downstream risk to email, SaaS, cloud, and internal systems.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Phishing resistance and authenticator choice directly affect trust decisions and account takeover risk. |
| Recommendation — Adopt phishing-resistant authentication for high-value accounts and reduce password-based reliance. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Phishing drives organisational account compromise through weak user authentication decisions. |
| Recommendation — Strengthen user authentication and enforce stronger authenticators for sensitive access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Phishing often succeeds by abusing accounts, sessions, and trust paths that account controls should constrain. |
| Recommendation — Harden account lifecycle and access review processes to reduce account compromise impact. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Phishing works by exploiting implicit trust; zero trust reduces the value of a single compromised decision. |
| Recommendation — Assume breach and verify each access request before granting sensitive access. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Phishing frequently results in stolen credentials or tokens that break authentication boundaries. |
| Recommendation — Treat phished credentials and tokens as broken authentication events and revoke them quickly. | ||
Practitioner Guidance
What to prioritise: Treat phishing awareness as a behaviour-control programme, not a communications campaign. Prioritise the actions that matter most in your environment, such as credential entry, MFA fatigue responses, OAuth consent prompts, and help-desk verification.
What to verify: Check whether users who complete training actually improve on simulated phishing, reporting speed, and safe escalation. If those measures do not move, the programme is educating without changing risk.
Common mistake: The usual error is to measure attendance and declare victory. The more useful test is whether the organisation is seeing fewer unsafe trust decisions and faster reporting when a lure does land.
Practitioner takeaway: Awareness starts the change, but repetition, feedback, and control design make the change durable; if the environment still rewards quick trust, susceptibility will stay high.
Related resources from NHI Mgmt Group
- Why do secrets stay dangerous even when they are no longer actively used?
- Why do even well-trained employees still fall for spear phishing in organisations with strong awareness programmes?
- Why do phishing programmes often fail even when completion rates are high?
- Why do phishing awareness programs still need simulated attacks even after classroom training?