Should organisations prioritise behavior change or awareness training first?

Why the sequence matters for security awareness

Awareness training is useful when people do not yet recognise the threat, the policy, or the expected response. But the practical outcome you care about is whether people change what they do under realistic pressure, because most security failures happen at the point of decision, not at the point of knowledge. That is why behaviour change belongs after basic awareness has created the minimum shared vocabulary.

For organisations, the real question is not whether people can repeat the message, but whether they can spot the cue, slow down, verify, and choose the secure action in time. A programme that only increases recognition can still leave risky habits unchanged. A programme that changes behaviour, by contrast, reduces exposure in the situations that matter most.

What separates awareness from behaviour change

Awareness is broad. It teaches the rule, the threat pattern, and the policy boundary. Behaviour change is narrower and more operational: it focuses on the specific action you want repeated, such as reporting suspicious messages, verifying requests out of band, using approved channels, or resisting shortcuts that bypass controls.

The distinction matters because different interventions produce different outcomes. Awareness campaigns tend to improve recall, while behaviour-focused measures change routines, friction points, and default choices. If an organisation treats those as the same thing, it can end up measuring completion rates instead of risk reduction.

Behaviour change is also where segmentation becomes important. SANS Security Resources is a useful reminder that security programmes work better when they are tied to practical operational context, because the right intervention for a high-risk team is rarely the same as the right intervention for the whole workforce.

How to decide what to do first

The first step is to confirm that the basics of awareness exist: people know the common threats, the reporting path, and the secure alternative. After that, measure the behaviours that actually matter to your exposure profile. Typical examples include report rates, verification rates, policy bypasses, repeat mistakes, and the time between exposure and action.

From there, prioritise the groups and workflows where the consequence of failure is highest. Not every population needs the same depth of intervention. Teams handling finance approvals, privileged requests, sensitive data, or external communications often need behaviour-focused reinforcement sooner than low-risk groups, because the cost of a bad decision is higher and the attack surface is more attractive.

A targeted approach also helps you avoid generic training fatigue. CIS Controls v8 supports this logic by emphasising operational safeguards, account practices, logging, and other controls that change what people and systems actually do, not just what they know.

Risk and Threat Considerations

When organisations stop at awareness, they often overestimate resilience. Attackers do not need every employee to be careless, they only need the few people who can approve, pay, reset, transfer, or disclose something valuable to take the wrong action once. That is why behaviour change matters most in high-consequence, high-pressure scenarios.

Failure mechanism: Awareness without reinforcement leaves habits, exceptions, and shortcuts intact. Under time pressure or social engineering pressure, people revert to the easiest available action, especially when the secure option is inconvenient or poorly embedded in the workflow.

Impact: The organisation keeps seeing the same classes of mistakes, even though completion metrics look healthy. Over time, this preserves avoidable exposure, weakens reporting quality, and gives attackers a reliable path through human decision points.

Practitioner Guidance

What to prioritise: Start with behaviour in the highest-risk workflows, not with a broad campaign that tries to fix everything at once. If a small set of decisions creates most of the exposure, focus interventions there first.

What to verify: Check whether the secure action is actually easier than the insecure one. If reporting, verifying, or escalating takes too many steps, awareness will not convert into behaviour at scale.

Decision rule: If people understand the message but still make the risky choice, treat the problem as a behaviour and control-design issue, not a communications problem.

Practitioner takeaway: Use awareness to establish baseline understanding, then use measured behaviour change to reduce real exposure, because security improves when the safer action becomes the default action.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• What happens when organisations rely on awareness posters and one-off training instead of continuous behavior change?
• When should organisations prioritise DMARC over more user-awareness training?
• Which framework updates should organisations prioritise first when regulations change and evidence is already fragmented?