Why security awareness plateaus after year one

At a glance

What this is: Hoxhunt says security awareness programs often stop improving after the first year because engagement fades and simulations become too easy to recognise.

Why it matters: This matters because IAM and security leaders need awareness programmes that change behaviour over time, not just complete annual training and preserve compliance metrics.

By the numbers:

• In the Hoxhunt Phishing Trends Report 2026, simulation failure rates fell from 3.4% at one year to 2.3% at two, while reporting climbed from 64.3% to 65.2%.
• The share of employees who had detected at least one real threat grew from 64% at twelve months to 71% at twenty-four.

Context

Security awareness plateaus when the programme is treated as a yearly training exercise rather than a control that must continuously adapt. The first-year gains are often real, but they can mask a deeper problem: the organisation is measuring participation and simulated clicks, not whether employees are becoming better at recognising and reporting real threats.

For IAM and human-risk teams, the boundary is clear. Awareness is useful when it changes user behaviour at the point of decision, but it loses value once simulations become predictable and training content stops reflecting the threats employees actually face. That makes the plateau a governance issue, not just a communications problem.

The article's starting position is typical for mature awareness programmes: strong launch, then diminishing returns once the novelty wears off.

Key questions

Q: What breaks when security awareness becomes predictable?

A: Predictable awareness programmes stop testing real judgement. Employees learn the simulation pattern instead of improving detection, so click rates may look better while real phishing resilience stalls. The control fails when the exercise is no longer realistic enough to force careful evaluation of messages and requests.

Q: Why do organisations need more than compliance-based security training?

A: Compliance training proves that people attended a session, but it does not prove they changed how they behave under pressure. The practical risk is a ceiling where completion stays high while reporting, hesitation, and threat recognition stop improving. Mature programmes must measure outcomes, not just participation.

Q: How can teams tell whether awareness training is actually changing behaviour?

A: Look at the trend, not the attendance sheet. A useful programme shows falling failure rates, rising report rates, and shorter time to report suspicious messages. If those numbers do not move, the organisation may be completing training without changing how people respond under pressure.

Q: When should organisations change their awareness approach after the first year?

A: They should change it as soon as early gains flatten or the same users keep failing the same scenarios. That usually means the programme has outgrown static content and needs more realism, segmentation, and behavioural measurement. Waiting for a formal failure only extends the plateau.

Technical breakdown

Why awareness metrics flatten after the first rollout

Security awareness programmes usually create early gains because employees are learning basic phishing cues, reporting paths, and safe response habits for the first time. Once those fundamentals are understood, repeated exposure to the same content produces diminishing returns. Completion rates can stay high while failure rates, reporting rates, and real-world vigilance stop improving. That gap appears because the programme is optimising for delivery, not for skill progression. In practice, the control has become static while the threat landscape and employee familiarity keep changing.

Practical implication: Treat flat metrics as a sign that the programme design has stopped evolving, not as proof that awareness is “good enough”.

How predictable simulations lose defensive value

A phishing simulation only improves judgement while employees still process it as a realistic threat. Once they learn the template, the exercise becomes a test of pattern recognition against the training system itself. At that point, the organisation is no longer training threat detection, it is training simulation recognition. The same failure mode appears when campaigns repeat identical lures, tone, or timing. Real attackers vary their tradecraft, so awareness content that does not vary will inevitably overstate readiness.

Practical implication: Rotate lure styles, delivery contexts, and difficulty so employees must evaluate messages, not just remember the exercise pattern.

Why behaviour change matters more than compliance completion

Compliance-led awareness programmes often measure whether training was completed, not whether behaviour changed. That creates a ceiling because these metrics prove activity, but not resilience. Behaviour change is the real outcome that matters: pausing before acting, verifying unexpected requests, and reporting suspicious activity quickly enough for response teams to use it. When the programme is not tied to those behaviours, it can look healthy on dashboards while leaving the organisation exposed to social engineering and phishing.

Practical implication: Measure reporting quality, response speed, and repeat susceptibility instead of relying on module completion alone.

NHI Mgmt Group analysis

Security awareness is a behaviour-control problem, not a content-delivery problem. The article correctly separates programme activity from risk reduction. Repeated training can preserve completion metrics while leaving reporting and detection habits unchanged. For identity and access programmes, that is the same failure pattern seen when controls verify attendance instead of ongoing decision quality. The practitioner conclusion is to manage awareness as a measurable behaviour system, not as an annual communications campaign.

The plateau is a governance signal that the control model is static. Once employees can recognise the simulation, the exercise has lost fidelity and the organisation is no longer testing real threat recognition. That matters because phishing and credential abuse are still common entry paths into identity compromise, and static human controls give attackers a stable target. The practitioner conclusion is to refresh scenarios with the same discipline used for technical control tuning.

Training fatigue creates human-risk debt. Repeating the same modules and examples builds familiarity without improving resilience, which means the organisation accumulates latent exposure even as dashboards look stable. This is especially relevant where awareness is expected to complement IAM, PAM, and email security, because human decision-making becomes the weak link in otherwise mature controls. The practitioner conclusion is to align training cadence with actual attacker behaviour, not with compliance calendars.

Adaptive difficulty is the named concept that separates activity from improvement. The article shows that users at different skill levels need different challenge levels if the programme is to keep producing gains. That is the difference between a programme that measures attendance and one that changes outcomes. The practitioner conclusion is to treat awareness as a dynamic control loop with segmentation, not a one-size-fits-all course.

What this signals

Security awareness plateaus when the programme is tuned for rollout momentum instead of ongoing resistance to phishing and social engineering. Once users learn the exercise pattern, the control stops proving much about real-world judgement. For practitioners, that means the question is not whether awareness is running, but whether it still changes decisions when attackers change tactics.

Adaptive difficulty is the control concept that matters most here. Employees do not all learn at the same pace, and a uniform programme eventually becomes too easy for some and too repetitive for others. Practitioners should segment by behaviour, then adjust challenge and reinforcement accordingly so the programme keeps producing new learning instead of reusing old lessons.

For practitioners

• Shift from completion metrics to behaviour metrics Track reporting quality, response speed, repeat failure patterns, and whether employees act on suspicious messages before they click. These are the signals that show whether awareness is reducing human risk.
• Increase simulation realism and variation Use different lure types, themes, timing patterns, and delivery styles so employees cannot rely on template recognition. The goal is to test judgement under realistic conditions, not recall of prior training.
• Apply adaptive difficulty by user segment Escalate challenge for consistently strong performers and provide targeted reinforcement for repeat clickers or high-risk roles. This keeps the programme aligned to actual skill level instead of averaging everyone together.
• Replace annual repetition with shorter reinforcement loops Break large modules into targeted refreshers that reinforce detection, verification, and reporting habits throughout the year. Shorter cycles are more likely to change behaviour than annual rereads of the same material.

Key takeaways

• Security awareness often stalls after the first year because repeat exposure, predictable simulations, and generic training stop creating new learning.
• The real weakness is not activity volume but the loss of behavioural progress, which makes dashboards look healthy while risk reduction flattens.
• Programmes break the plateau by changing difficulty, varying scenarios, and measuring whether employees actually report and respond differently.

Key terms

• Security Awareness Plateau: A security awareness plateau is the point at which training activity continues but employee behaviour stops improving. It usually appears after early rollout gains fade, showing that the programme is measuring participation more effectively than it is changing human decision-making under attack pressure.
• Behavior Change Measurement: Behavior change measurement tracks whether people and AI agents make safer decisions after an intervention. It goes beyond completion counts and looks for reduced repeat risk, better reporting, and fewer exposure events over time. The strongest evidence comes from comparing performance against a baseline in real working conditions.
• Adaptive Difficulty: Adaptive difficulty is the practice of adjusting training challenge to match the learner's current skill level. In security awareness, it keeps experienced users challenged while giving weaker performers targeted reinforcement, preventing the programme from becoming too easy, too repetitive, or too frustrating.
• Training Fatigue: Training fatigue is the point at which repeated security messages stop getting attention because users feel overloaded, disengaged, or unconvinced. In practice, it weakens retention and makes people less likely to change behaviour. The problem is usually caused by generic content, poor timing, or too much compliance messaging without context.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, human identity, and secrets management through the industry's only accredited NHI security programme. It helps practitioners connect identity controls to the human behaviours that shape risk across the wider security programme.