Security awareness plateau: what changes after the first year?

TL;DR: Security awareness programs often flatten after year one because training becomes predictable, simulations lose realism, and organisations keep measuring activity instead of behaviour change, according to Hoxhunt. The plateau is not inevitable: adaptive difficulty and varied simulations can keep human risk reduction moving.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “Why Security Awareness Plateaus After Year One”.

By the numbers:

• In the Hoxhunt Phishing Trends Report 2026, simulation failure rates fell from 3.4% at one year to 2.3% at two, while reporting climbed from 64.3% to 65.2%.
• The share of employees who had detected at least one real threat grew from 64% at twelve months to 71% at twenty-four.

Key questions

Q: What breaks when security awareness becomes predictable?

A: Predictable awareness programmes stop testing real judgement.

Q: Why do organisations need more than compliance-based security training?

A: Compliance training proves that people attended a session, but it does not prove they changed how they behave under pressure.

Q: How can teams tell whether awareness training is actually changing behaviour?

A: Look at the trend, not the attendance sheet.

Practitioner guidance

• Shift from completion metrics to behaviour metrics Track reporting quality, response speed, repeat failure patterns, and whether employees act on suspicious messages before they click.
• Increase simulation realism and variation Use different lure types, themes, timing patterns, and delivery styles so employees cannot rely on template recognition.
• Apply adaptive difficulty by user segment Escalate challenge for consistently strong performers and provide targeted reinforcement for repeat clickers or high-risk roles.

Bottom line: Security awareness often stalls after the first year because repeat exposure, predictable simulations, and generic training stop creating new learning.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →