Topic starter
24/10/2026 8:53 pm
TL;DR: Employee cybersecurity training falls short when it measures attendance instead of whether people change behaviour under attack conditions, according to Hoxhunt. Training has to be judged by fewer risky actions, or phishing, deepfakes and MFA fatigue still find a path in.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “Cybersecurity Training for Employees: What to Teach, How Often, and How to Prove It Works”.
By the numbers:
- Hoxhunt’s Phishing Trends Report 2026 covers more than 50 million phishing simulations sent to over 4 million users in 125 countries.
- AI-written emails accounted for 56% of the threats employees reported in December 2025.
- The reporting rate is 13 points lower on mobile than on desktop.
Key questions
Q: Why do deepfakes and voice phishing make old awareness training less effective?
A: Because the old visual cues disappear.
Q: What are the signs that password and MFA training is failing?
A: Look for repeated approvals of unexpected prompts, users who ignore sign-in alerts, and high-risk sign-in patterns that persist after coaching.
Q: How should security teams reduce phishing risk without relying only on awareness training?
A: They should combine user training with behavioural detection, vendor verification, and tighter controls on high-risk identity actions.
Practitioner guidance
- Build role-based phishing simulations Match lure difficulty and scenario type to the employee’s job function, region and the threats they actually see so the practice resembles live attacks.
- Require out-of-band verification for high-risk requests Make callback checks mandatory for money movement, bank detail changes, data sharing and access grants so a convincing voice or video call cannot stand alone.
- Tune MFA coaching to denial behaviour Teach employees to reject prompts they did not initiate and trigger immediate coaching when repeated prompts or risky sign-ins appear.
Bottom line: Employee cybersecurity training fails when it measures attendance instead of whether people actually change behaviour under attack conditions.
Glossary terms: Security Awareness Training, Phishing Simulation Workflow, MFA Fatigue, Deepfake-based impersonation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Behaviour change is the real control, not training completion: employee cybersecurity training only matters when it reduces risky action under pressure. Completion metrics tell you who clicked through a course, not whether people will deny a suspicious prompt, verify a call-back request or avoid a risky share. The operational question is whether training changes decisions at the point of attack, which is why leaders should measure reporting, refusal and repeat-risk reduction, not attendance.
A question worth separating out:
Q: How do organisations keep employee training relevant as work moves to mobile and AI tools?
A: Train the behaviour that happens in the browser and on the phone, not just in a classroom. That means mobile simulations, policy-based nudges before risky sharing, and clear rules for approved AI tools and public networks. Relevance comes from training the actual context where mistakes happen.
👉 Read our full editorial: Employee cybersecurity training fails without behavior change
This post was modified 6 days ago by NHI Mgmt Group