Topic starter
27/06/2026 2:06 pm
TL;DR: Legacy security awareness training fails when employees share answers, skip modules, and tune out simulations, even though 99% of organisations saw incidents tied to preventable user actions in 2024 and 60% of breaches involved the human element, according to Abnormal AI. The practical shift is from completion metrics to measurable behaviour change, threat recognition, and timely feedback that fits how people actually work.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “From Compliance to Culture: What CISOs Need to Know About Evolving SAT”.
Key questions
Q: How do security teams know if security awareness training is actually working?
A: Look for reductions in susceptibility over time, improved reporting behaviour, and fewer successful phish-to-access events.
Q: Why do compliance-based training programmes fail against phishing and social engineering?
A: They fail because users can game completion and because annual content does not reach the moment of decision.
Q: What are the best ways to reduce preventable user-action incidents?
A: Use timely, role-specific feedback tied to real user exposure, then reinforce it with repeated measurement of response quality.
Practitioner guidance
- Shift success metrics to behaviour change Track whether users recognise, report, and avoid risky interactions over time, rather than treating completion rates as proof of security improvement.
- Deliver feedback at the point of risk Use inbox-level or workflow-adjacent prompts so training arrives when the employee is actually deciding whether to trust a message or action.
- Segment training by role and exposure Tailor scenarios and guidance to the message types, business processes, and fraud patterns that different employee groups actually encounter.
Bottom line: Legacy security awareness training fails when it rewards completion more than safer decisions under pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 3:42 pm
Human-risk training fails when the control measures attendance instead of decision quality: Security awareness programmes that reward completion assume the user has changed behaviour, but the article shows that employees can share answers, skip content, and still look compliant. That means the programme is optimising for audit traceability, not reduced susceptibility. The practitioner conclusion is that SAT must be judged by whether it changes actions under pressure.
A question worth separating out:
Q: How do security teams keep awareness programmes relevant as threats change?
A: Refresh training based on the tactics users actually encounter, not on an annual plan. When lures evolve, the programme should adapt its examples, timing, and feedback so employees see the current attack pattern and the correct response while it still matters.
👉 Read our full editorial: AI-powered security awareness training shifts focus from compliance