Topic starter
11/11/2026 6:05 pm
TL;DR: Security awareness content reaches employees six to seven times a month, according to MetaCompliance, yet most CISOs still see a gap between delivery and understanding. Awareness programmes need role-aware interventions and behaviour signals, otherwise training volume becomes noise.
Editorial analysis by NHI Mgmt Group, based on content published by MetaCompliance: “Stop Spamming Your Employees: How to Make Security Awareness Training More Targeted”.
By the numbers:
- 75% of CISOs still believe employees do not fully understand their role in preventing security incidents.
Key questions
Q: Why does generic security awareness training fail in high-risk roles?
A: Generic training fails because it ignores context.
Q: Why do phishing simulations often fail to change behaviour?
A: They fail when they are generic, delayed, or disconnected from the attacks employees are actually seeing.
Q: How should organisations choose security awareness training topics for different employee roles?
A: Start with role-based risk, not a generic curriculum.
Practitioner guidance
- Segment awareness by role and access Group employees by exposure to financial processes, privileged systems, executive impersonation risk and other concrete threat contexts, then tailor the scenarios they see.
- Trigger interventions from behaviour signals Use phishing simulation outcomes, reporting patterns and repeat-risk indicators to decide who needs immediate follow-up rather than waiting for the next scheduled campaign.
- Reduce generic content volume Keep a baseline awareness programme, but remove redundant campaigns that deliver the same message to low-risk groups without a new threat or decision context.
Bottom line: Blanket awareness programmes are easy to deliver but poor at distinguishing who actually needs intervention.
Glossary terms: Security Awareness Training, Phishing Simulation, Human Cyber Risk, Behavioural Signal
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Training frequency is a weak proxy for human risk reduction. When employees receive the same volume of content regardless of role or behaviour, the programme measures delivery instead of decision quality. That is why completion dashboards can look healthy while risk remains unchanged. Security teams should treat frequency as a support variable, not the control objective.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations tell if human-risk management is working?
A: Look for downward trends in behavioural susceptibility, improved performance in realistic simulations, and better targeting of coaching to higher-risk groups. If the programme only reports attendance or click rates, it is measuring activity, not security improvement.
👉 Read our full editorial: Role-aware security awareness improves behavior more than frequency