Should organisations keep investing in security awareness training for phishing?

Why phishing awareness training still matters, but only as a supporting control

security awareness training remains useful because it improves recognition, reduces click-through, and gives employees a shared vocabulary for reporting suspicious messages. But phishing has shifted from simple bait emails to identity-driven compromise paths, so training alone does not stop token theft, session hijacking, or consent abuse once a user interacts with a malicious prompt.

The practical value of training is strongest when it is tied to specific attacker patterns, such as credential prompts, fake document shares, and consent screens. That is why organisations should treat training as one layer in a wider control stack, not as evidence that the phishing problem is “solved.”

Where organisations usually go wrong is assuming that a better-trained user can compensate for weak runtime protection. In reality, the attack succeeds or fails at the point where a browser, session, or identity flow is being abused, which means prevention needs controls that can inspect and constrain that live transaction.

Why browser-time controls usually outperform awareness alone

Phishing is effective because it compresses decision time. The user is asked to trust a message, follow a link, and hand over an authentication step in a very short window. Runtime controls reduce that pressure by checking the destination, blocking malicious redirects, constraining risky authentication flows, and detecting token exfiltration or suspicious browser behaviour as it happens.

This is especially important when the attack targets identity material rather than just passwords. A successful phish may capture an OTP, a session cookie, an OAuth consent grant, or access to a cloud console that contains secrets. In those cases, the browser and identity layer need to be defended together, because the harm often comes after the initial login, not at the login page itself.

For practical prevention, the question is not whether users can be taught to be careful. The question is whether the organisation can detect and stop malicious action fast enough to matter. Controls that operate in the browser or at the identity boundary are better suited to that task than a training programme that depends on perfect human judgement under time pressure.

For examples of how phishing turns into repository access, token theft, or exposed secrets, see Dropbox GitHub breach 2022, CoPhish OAuth phishing via Copilot Studio, and Ledger Connect Kit npm compromise 2023.

What a balanced anti-phishing control stack looks like

A mature approach blends awareness with technical prevention and fast response. Training should teach people to pause, verify, and report. The control stack should then reduce the chance that one mistake becomes a breach by using phishing-resistant authentication, suspicious-link handling, browser isolation or filtering, rapid credential rotation, and monitoring for impossible or unusual session behaviour.

That balance matters because phishing is not one problem. It is a family of attack paths that range from classic credential harvesters to OAuth consent abuse and phishing of developers or administrators. Some of those paths bypass the value of training almost entirely, which is why organisations should measure the control set by outcomes such as reduced successful takeovers, faster reporting, and lower blast radius after a click.

Training also works best when it is operationally specific. Users remember examples that match the organisation’s actual workflows, such as document-sharing prompts, SSO reauthentication pages, help-desk impersonation, or consent prompts that ask for permissions no ordinary workflow should need. Generic “do not click suspicious links” advice is much less effective than scenario-based guidance that mirrors the real threat surface.

Useful general guidance on incident handling and phishing defence practice can be found in SANS Security Resources. For authentication design that raises the bar against phishing, see NIST SP 800-63 Digital Identity Guidelines.

How to decide whether training is doing enough

Keep investing in training when it is improving reporting quality, reducing repeat mistakes, and supporting the rollout of stronger controls. Stop treating it as the primary defence if the organisation still relies on passwords, weak MFA, manual exception handling, or unmanaged browser exposure to reach business-critical systems.

Decision rule: if the attack path ends with stolen credentials, stolen tokens, or unauthorised consent, prioritise runtime prevention and phishing-resistant authentication before expanding the awareness curriculum. Training should then reinforce the technical controls already in place, not carry the main burden of defence.

Practitioners should also verify that training outcomes are being measured against actual attack behaviour, not course completion. Completion rates are easy to report, but they do not show whether people recognised the phish, reported it quickly, or avoided exposing a session or token. The better signal is whether the organisation can absorb a phish without a material compromise.

Practitioner takeaway: Awareness training is worth funding, but only if it is treated as a human-support control wrapped around stronger technical prevention, especially at the browser and identity boundary.

Related resources from NHI Mgmt Group

• How should organisations keep security awareness messaging consistent across training, phishing simulations, and user communications?
• How should organisations adapt security awareness training for generative AI phishing?
• Why do employee data breaches keep happening even when organisations already run security awareness training?
• Should organisations rely on security awareness training or stronger authentication for phishing defence?