Common signs include relying only on click rates, seeing inconsistent simulation outcomes, and failing to connect training to real attack exposure. If the program cannot explain what users struggle with or who is being targeted now, it is likely missing the users who need prioritized attention and tailored education.
How to tell the program is missing its highest-risk users
A security awareness program usually misses its highest-risk users when it reports overall activity but cannot distinguish who is actually exposed, targeted, or likely to fail under current attack conditions. The warning sign is not low participation alone, but a mismatch between training metrics and real risk. When the program cannot identify which groups need more attention, it is measuring completion, not resilience.
One common symptom is that reporting stays at the aggregate level. If the team can only say how many users finished a course, how many clicked a simulation, or how many people attended a session, it may be blind to which roles, locations, business units, or behaviors are repeatedly showing weak signals. That gap matters because targeted training should follow exposure, not just calendar cadence. For a broader control lens, many teams anchor this work in NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST Cybersecurity Framework 2.0, which both encourage risk-aware, measurable security governance.
A second sign is that simulations produce inconsistent outcomes that are never translated into segmentation. If the same people keep failing the same scenarios, or if certain groups systematically underperform on phishing, impersonation, or reporting behavior, the program should be using that evidence to prioritize follow-up. Without that step, the organization may be treating training as a uniform message instead of a risk control with different intensity for different users.
A third warning sign is weak linkage between awareness content and actual attack exposure. If the program does not use incident trends, phishing telemetry, help-desk patterns, or targeted attack reports to decide who gets coached next, then it is likely missing the people most likely to be abused in the current threat environment. A useful comparison point is MITRE ATT&CK Enterprise Matrix, which helps teams think in terms of adversary behavior rather than generic awareness topics.
What the blind spots look like in practice
The blind spot is often structural rather than technical. Teams may know the company-wide completion rate, but not which high-risk users have elevated exposure because of role, privilege, external contact, payment authority, executive visibility, or access to sensitive workflows. They may also be missing users who are not failing dramatically, but are failing in ways that matter more, such as repeating poor judgment on suspicious requests, delayed reporting, or poor verification habits in high-pressure situations.
Another practical clue is when the program cannot explain why a given audience was selected for extra attention. If there is no clear rationale tied to observed risk, then prioritisation is likely based on convenience, visibility, or management pressure rather than threat reality. That is usually a sign that the awareness function is operating as a broadcast channel instead of a triage mechanism.
Why this matters for the control itself
Security awareness is only useful when it reduces exposure in the places where an attack is most likely to succeed. A program can look healthy if it reaches everyone, but still fail if the organisation does not know which users are being targeted now, which ones are repeatedly vulnerable, and which ones sit closest to high-impact actions. That is why a control-oriented view of user awareness should be tied to prioritisation, not just coverage.
Program owners should also expect that the “highest-risk users” will change over time. New campaigns, business changes, access changes, and attacker trends can shift the most exposed groups quickly. A static training plan often falls behind that movement. Good programs refresh targeting based on new evidence rather than assuming last quarter’s risk pattern still holds.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OV-01 — Oversight of the Cybersecurity Risk Management Strategy | Awareness targeting needs governance over whether the control matches current risk. |
| ID.RA-01 — Asset vulnerabilities and threats are identified and recorded | High-risk-user targeting depends on identifying current threats and exposed user groups. | |
| Recommendation — Review awareness metrics against current exposure and adjust priorities when the highest-risk groups change. Use threat and exposure data to target awareness efforts at the users most likely to be attacked. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | This question is directly about whether awareness training is reaching the right people. |
| Recommendation — Segment training by role and exposure so higher-risk users get more frequent, targeted reinforcement. | ||
| MITRE ATT&CK | T1566 — Phishing | Phishing remains a common attack path that awareness programs try to reduce through targeted training. |
| Recommendation — Map failed simulations and incidents to phishing techniques to focus follow-up on the most exposed users. | ||
Practitioner Guidance
What to prioritise: Start by identifying whether the program can segment users by exposure and behavior, not just by attendance or completion. If it cannot, the next improvement is not more training content, but better targeting logic and better signal collection.
What to verify: Check whether simulation results, incident reports, and business-role exposure are being reviewed together. A useful test is whether the team can name the few user groups that currently deserve extra coaching and explain why those groups were chosen.
Common mistake: Do not treat click rate as the main outcome. It is one signal, but it is not enough to show that the programme is finding the users who are most likely to create real-world risk.
Practitioner takeaway: If the program cannot connect user behavior to current attack exposure, it is probably teaching the whole workforce at once while missing the users who most need intervention first.
Related resources from NHI Mgmt Group
- What are the signs that a cloud email security program is missing novel attacks?
- What are the signs that a security program is too focused on eliminating risk instead of managing it?
- What are the signs that an email security program is failing to stop compromise quickly enough?
- Why do cloud applications create security risk when users can deploy them without IT involvement?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
