Why do annual security courses fail to lower risky behaviour?

Why This Matters for Security Teams

Annual awareness courses often create a false sense of coverage. Completion records are easy to report, but they do not prove that staff can recognise a phishing lure, resist an urgent payment request, or challenge an unusual login prompt under time pressure. That gap matters because the real objective is not training attendance; it is reducing unsafe decisions in normal workflows. The NIST Cybersecurity Framework 2.0 places emphasis on outcomes, governance, and continuous improvement, which is a better fit than treating security education as a once-a-year compliance task.

Security teams also tend to underestimate context. A person who knows the “right answer” in a quiz may still comply when the request comes from a trusted executive account, a familiar supplier, or a chat channel that feels routine. Risky behaviour is usually situational, shaped by urgency, ambiguity, workload, and perceived authority. That is why mature programmes measure behaviour change, reporting rates, and control effectiveness, not only course completion. In practice, many security teams encounter failure only after a real phishing, fraud, or account takeover event has already occurred, rather than through intentional behaviour testing.

How It Works in Practice

Annual courses fail when they rely on passive learning and generic content instead of reinforcing decision-making in realistic contexts. People forget detail quickly, especially if the course is broad, disconnected from their role, and not followed by practice. Security awareness works better when it is continuous, role-aware, and paired with controls that make the safe choice easier than the risky one.

Operationally, that means moving from “everyone gets the same module” to a layered programme:

• Use short, frequent interventions tied to current threats, such as phishing themes, invoice fraud, or MFA fatigue.
• Tailor content by role, since finance, HR, engineering, and executives face different social engineering patterns.
• Test behaviour with simulations that mirror actual channels and urgency, then measure reporting and escalation quality.
• Reinforce lessons with clear workflows, such as verification steps for payments, identity checks for resets, and escalation paths for suspicious messages.
• Support training with technical guardrails, including email filtering, conditional access, privileged access controls, and strong identity verification.

This is also where identity and access management intersect with awareness. If an employee cannot easily verify whether a request is genuine, the training burden rises. If privileged workflows are weak, a single mistake can become a major incident. For that reason, awareness should be treated as one element of a broader control system, not as a stand-alone defence. NIST guidance on security programmes and identity assurance is most useful when it is translated into repeatable behaviours, not slides. For identity-sensitive workflows, the control intent in NIST SP 800-63 Digital Identity Guidelines is especially relevant.

These controls tend to break down in high-change environments with rapid hiring, heavy outsourcing, or fragmented communication channels because employees receive inconsistent cues about what “normal” looks like.

Common Variations and Edge Cases

Tighter training often increases time burden and user fatigue, requiring organisations to balance repetition against operational disruption. That tradeoff matters because more content does not automatically mean better judgement. In some environments, especially fast-moving sales teams, incident-response functions, or multilingual workforces, a long annual module may perform worse than shorter scenario-based reinforcement.

There is also no universal standard for how often awareness should be delivered or which metric best proves improvement. Current guidance suggests that leaders should combine simulations, reporting trends, phishing resistance, and incident data rather than rely on quiz scores alone. If employees are repeatedly tested with unrealistic traps, they can learn to distrust all messages, which is not the goal. The aim is to improve discrimination, not create blanket suspicion.

Edge cases include contractors, third parties, and highly privileged users. Contractors may not receive enough context to recognise internal processes. Privileged users may need deeper training on escalation and verification because their mistakes carry higher impact. In regulated environments, awareness should also be aligned to broader governance and risk management expectations, including resilience and monitoring under NIST Cybersecurity Framework 2.0. Where identity proofing or account recovery is part of the risk, the lesson is simple: security education must be reinforced by process and technical controls, or it becomes a checkbox.

Related resources from NHI Mgmt Group

• Why do broad awareness campaigns often fail to change security behaviour?
• Why do control plane tools fail to prevent risky AI agent behaviour?
• Why does annual security awareness training fail against modern phishing?
• How should security teams detect risky AI agent behaviour in production?