Topic starter
11/11/2026 6:01 pm
TL;DR: Generic security awareness campaigns often fail because they are too broad, too infrequent and too detached from actual employee risk, according to MetaCompliance. Completion metrics alone do not show whether behaviour has changed, so programmes need continuous, role-aware reinforcement to reduce human cyber risk.
Editorial analysis by NHI Mgmt Group, based on content published by MetaCompliance: “Common Mistakes in Delivering Cyber Security Awareness Campaigns”.
Key questions
Q: How do phishing simulations support awareness programmes?
A: Phishing simulations support awareness programmes by testing whether people recognise malicious email, links and login pages, then measuring click, reply and report behaviour.
Q: What makes social engineering harder to stop in large organisations?
A: social engineering is harder to stop in large organisations because attackers can exploit many people, teams and business processes, often by using tailored pretexts, urgent requests and impersonation.
Q: How do organisations measure whether awareness campaigns are actually improving security behaviour?
A: Measure outcomes, not just completion.
Practitioner guidance
- Design role-specific awareness paths Build separate learning tracks for finance, HR, executives and general staff so each group sees the scams and requests most likely to reach them.
- Measure behavioural change, not attendance Track phishing simulation outcomes, report rates, repeat risky actions and department-level trends instead of relying on course completion alone.
- Increase reinforcement frequency Replace annual-only training with shorter, recurring interventions tied to current threats, especially impersonation, credential theft and malicious request patterns.
Bottom line: Security awareness fails when it is treated as a generic compliance exercise rather than a behaviour-changing control.
Glossary terms: Security awareness campaign, Phishing Simulation, Social Engineering, Credential Theft
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Generic awareness is a control weakness, not a communications problem. The failure mode here is treating training as a broadcast rather than a governance control that changes behaviour at the point of risk. When content is too broad, employees cannot map it to the requests they actually receive, so the programme records exposure rather than reducing it. The practical consequence is that human judgement remains predictable enough for phishing and impersonation to keep working.
A question worth separating out:
Q: What signs suggest employees are still vulnerable to credential theft?
A: Employees are still vulnerable to credential theft when they reuse passwords, approve unexpected MFA prompts, fall for fake login pages, or fail to report suspicious emails and messages. Repeated credential resets, unusual account lockouts and successful phishing simulations can also show that password and authentication controls are not yet embedding safe habits.
👉 Read our full editorial: Generic security awareness fails without role-based reinforcement