What are the signs that a security awareness program is too generic to change behaviour?

When “security awareness” becomes generic instead of behaviour-changing

The first warning sign is sameness. If the same module, quiz, and reminder are pushed to everyone, the program is optimised for completion metrics, not for changing decisions in daily work. A behaviour-changing program recognises that finance, engineering, support, and executives face different pressure points, so the message, examples, and timing should differ.

Another sign is that the content stays at the level of slogans. If the material explains what employees should avoid but not the specific situations they actually encounter, people may remember the rule and still miss the application. Generic programs also tend to recycle old phishing examples, ignore recent threat patterns, and fail to connect training to the tools, processes, and approval paths that shape real behaviour.

Weak feedback loops are another giveaway. If success is measured mainly by attendance, clicks, or annual completion, the program can look healthy while behaviour stays unchanged. More useful indicators are whether staff report suspicious messages faster, make fewer repeated mistakes, and apply the guidance correctly in the systems they use every day.

What weak engagement and low retention usually tell you

When a program is too generic, people often treat it as background noise. That shows up as low participation in optional content, rapid forgetting after the session, and low confidence when someone has to decide in a real scenario. The problem is not simply that people are busy, it is that the material does not feel specific enough to be worth remembering.

Low retention also appears when the program is disconnected from recent events. Training that does not reference current attack patterns, current business changes, or the actual mistakes the organisation keeps making is easy to dismiss. Employees are more likely to remember examples that mirror their own work, especially when the consequences are concrete rather than abstract.

A further signal is that managers cannot point to any observable change in practice. If the organisation cannot show fewer repeated policy violations, better reporting of suspicious activity, or better handling of common risky situations, then the programme may be informative without being formative. That is a sign to rework the curriculum, not to add more of the same content.

What a program needs in order to change behaviour

Behaviour change usually comes from specificity, repetition, and context. The strongest programs map training to role-based risk, use realistic scenarios, and reinforce the same decisions in multiple ways over time. They do not try to teach every possible security topic at once; they target the handful of choices that matter most for that audience.

The content should also connect directly to day-to-day actions. People need to see what good looks like in their own workflow, not just hear what the policy says. That means using examples tied to current threats, showing the actual decision points employees face, and making it clear what to do next when something looks wrong.

Useful programs also include measurement that goes beyond completion. If the training is working, you should see clearer reporting, fewer recurring errors, and better judgment in simulations or real events. Without those signals, the program may still satisfy a compliance need, but it will not prove that behaviour is improving.

Risk and Threat Considerations

Generic awareness programmes create a predictable control gap: employees learn the organisation’s vocabulary without learning the decisions that prevent harm. That leaves the business exposed to repeated social engineering, policy bypass, and avoidable human-error incidents, especially where roles carry different levels of access or operational authority.

Failure mechanism: Broad, undifferentiated messaging creates shallow recall, so employees may recognise a concept in theory but fail to apply it under pressure, in a hurry, or in a role-specific workflow.

Impact: The organisation gets measurable training activity without measurable risk reduction, and the same mistakes can keep recurring across phishing, handling of sensitive data, or approval decisions.

Practitioner Guidance

What to verify: Check whether the programme is aligned to role, task, and recent threat patterns, not just to a yearly schedule. If the same content is sent to everyone, that is usually a sign the control is too broad to influence daily decisions.

What to measure: Look for operational signals such as faster reporting, fewer repeated mistakes, and better outcomes in scenario-based testing. Completion rates alone are a weak indicator because they do not show whether people changed how they act.

Practitioner takeaway: A security awareness programme changes behaviour only when it is specific enough to feel relevant at the point of decision, otherwise it becomes training theatre rather than a control.

Related resources from NHI Mgmt Group

• Why do broad awareness campaigns often fail to change security behaviour?
• What breaks when organisations rely on generic security awareness training instead of behaviour-based risk management?
• What are the signs that an application security program is too noisy to scale?
• What are the signs that a security awareness program is not engaging employees effectively?