Topic starter
24/10/2026 8:48 pm
TL;DR: Security awareness programmes often stall after the first year because repeat exposure, predictable simulations and generic training stop creating new learning, according to Hoxhunt. Behaviour tracking then matters more than activity counts if teams want to keep risk reduction moving.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “Why Security Awareness Plateaus After Year One”.
By the numbers:
- In the Hoxhunt Phishing Trends Report 2026, simulation failure rates fell from 3.4% at one year to 2.3% at two, while reporting climbed from 64.3% to 65.2%.
- The share of employees who had detected at least one real threat grew from 64% at twelve months to 71% at twenty-four.
Key questions
Q: Why do organisations need more than compliance-based security training?
A: Compliance training proves that people attended a session, but it does not prove they changed how they behave under pressure.
Q: How can teams tell whether awareness training is actually changing behaviour?
A: Look at the trend, not the attendance sheet.
Q: What breaks when security awareness becomes predictable?
A: Predictable awareness programmes stop testing real judgement.
Practitioner guidance
- Shift from completion metrics to behaviour metrics Track reporting quality, response speed, repeat failure patterns, and whether employees act on suspicious messages before they click.
- Increase simulation realism and variation Use different lure types, themes, timing patterns, and delivery styles so employees cannot rely on template recognition.
- Apply adaptive difficulty by user segment Escalate challenge for consistently strong performers and provide targeted reinforcement for repeat clickers or high-risk roles.
Bottom line: Security awareness often stalls after the first year because repeat exposure, predictable simulations, and generic training stop creating new learning.
Glossary terms: Security Awareness Plateau, Behavior Change Measurement, Adaptive Difficulty, Training Fatigue
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Security awareness is a behaviour-control problem, not a content-delivery problem. The article correctly separates programme activity from risk reduction. Repeated training can preserve completion metrics while leaving reporting and detection habits unchanged. For identity and access programmes, that is the same failure pattern seen when controls verify attendance instead of ongoing decision quality. The practitioner conclusion is to manage awareness as a measurable behaviour system, not as an annual communications campaign.
A question worth separating out:
Q: When should organisations change their awareness approach after the first year?
A: They should change it as soon as early gains flatten or the same users keep failing the same scenarios. That usually means the programme has outgrown static content and needs more realism, segmentation, and behavioural measurement. Waiting for a formal failure only extends the plateau.
👉 Read our full editorial: Security awareness stalls when training stops changing
This post was modified 6 days ago by NHI Mgmt Group