When training is not personalised, it usually feels generic, repetitive, and disconnected from daily work. That lowers attention, reduces retention, and makes it harder to shift habits such as phishing avoidance or password reuse. The organisation then spends time and money on content delivery while gaining little improvement in actual security behavior.
Why Generic Training Fails to Change Behavior
Personalisation matters because awareness training competes with everything else in the user’s workday. When the examples, language, and scenarios do not reflect the systems, channels, and decisions people actually use, the content becomes easy to ignore. That is not just a communications problem, it is a control weakness: a training programme that does not connect to daily context rarely changes the decisions that create risk.
Generic material also tends to flatten different user populations into the same advice. That can leave high-exposure groups, such as people handling sensitive approvals, payments, customer data, or admin workflows, with the wrong level of depth. The result is predictable, low-friction consumption of the lesson but weak transfer into real-world judgement.
What Changes When Training Is Matched to the User
Personalised training works better because it links the lesson to familiar cues, likely mistakes, and the actual actions a user can take. A finance user needs to recognise invoice fraud patterns; a developer needs to recognise risky links, token handling, and repository prompts; a manager needs to spot approval abuse and social pressure. When the scenario resembles the user’s routine, the training is more likely to be remembered and applied.
That shift is especially important for repeat behaviours such as phishing response, password hygiene, data handling, and escalation paths. The goal is not to make every lesson unique for its own sake. The goal is to align the message to role, environment, and risk so the user can immediately translate the warning into a concrete next action.
In security programmes where identity and access are part of the risk picture, the training should also reflect what the user can actually expose or approve. NHIMG’s Ultimate Guide to Non-Human Identities notes that 97% of NHIs carry excessive privileges, which is a reminder that a single poor decision can widen blast radius quickly when accounts, tokens, or integrations are over-permissioned.
Risk and Threat Considerations
When training is too generic, the organisation creates a false sense of readiness. Users may recognise the terminology but still miss the specific cues that matter in their workflow, which leaves phishing, credential theft, and unsafe approval behaviour largely unchanged. Over time, the gap between policy knowledge and day-to-day action becomes the real exposure.
Failure mechanism: The programme optimises for content completion instead of behaviour change, so users learn broad slogans but do not practise the decisions that matter in their own context. Attackers benefit when staff can recite the rule but fail to recognise the real message, sender, attachment, or request pattern in a familiar work scenario.
Impact: Lower retention, weaker reporting, and continued susceptibility to social engineering, credential reuse, and misdirected approvals. At scale, that means more preventable incidents and more spend on training activity that does not materially reduce risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 14.2 — Security Awareness and Skills Training | Directly supports role-aware awareness training that changes user behaviour. |
| Recommendation — Tailor awareness content to user roles and repeat the training on the phishing and handling behaviours each group actually faces. | ||
| NIST CSF 2.0 | PR.AT-01 — Awareness and Training | Applies because awareness must be understandable and usable by the workforce it targets. |
| PR.AT-02 — Role-Based Awareness and Training | Directly addresses the need to personalise training by job function and exposure. | |
| PR.AT-03 — Third-Party Workforce Awareness and Training | Relevant where contractors or external users need training matched to their access and responsibilities. | |
| Recommendation — Align awareness content to the audience so training improves day-to-day security decisions. Deliver role-based scenarios that match the decisions, data, and attack paths each user group actually encounters. Provide tailored training to third parties so their awareness matches the systems and data they can reach. | ||
Practitioner Guidance
What to verify: Check whether the training path differs by role, system exposure, and common attack path. If every user gets the same module, the programme is probably measuring distribution, not resilience. The useful test is whether a user can describe the correct action in a realistic scenario from their own work, not whether they can recognise the generic definition of a scam.
What to prioritise: Tailor the highest-frequency and highest-consequence behaviours first, such as phishing response, authentication prompts, payment approval, and data-sharing decisions. That is where personalisation pays back fastest because the lesson maps directly to a repeated security choice.
Common mistake: Treating personalisation as branding or role labels on the same content. Effective tailoring changes the scenario, the decision point, or the consequence the user is meant to recognise.
Practitioner takeaway: Personalised training is valuable when it changes judgement in the moment of action, if the lesson cannot be recognised in the user’s real workflow, it is unlikely to change behaviour.
Related resources from NHI Mgmt Group
- What do security teams get wrong about user awareness training for browser threats?
- How should organisations modernise security awareness training so it actually changes user behaviour?
- What is the difference between user-led remediation and traditional security awareness training for secrets exposure?
- What should security teams measure after awareness training?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
