Why do awareness campaigns make attacks seem higher than they really are?

Why awareness drives a visibility spike, not necessarily a threat spike

Awareness campaigns change the human side of detection. They teach staff to recognise suspicious email, login prompts, payment requests, and unusual file-sharing behaviour, then report what they see. That means the organisation often observes more alerts, tickets, and escalations after training even if adversary activity stays flat. CISA cyber threat advisories remain useful here because they show how threat reporting and public warning can expand visibility without proving a fresh compromise. In practice, many security teams encounter the reporting surge only after a campaign changes user attention, rather than through any intentional increase in attacker activity.

How to read the post-training surge in practice

The key distinction is between exposure and evidence. A campaign that improves awareness often lowers the threshold for reporting, so the organisation starts capturing events that were previously ignored, misclassified, or never escalated. That can include benign phishing simulations, real phishing emails, user confusion about policy reminders, and legacy suspicious messages that would otherwise have remained invisible. The result is a higher apparent incident rate, but the denominator has changed: more people are looking, more people understand what matters, and more people are willing to report.

This is why teams should separate operational signals into at least three buckets:

• confirmed malicious activity, where indicators support a real adversary action;
• benign-but-suspicious reports, where the item is odd but not malicious;
• training effect, where a rise in reports reflects improved awareness rather than new attacker volume.

That distinction matters for executive reporting, triage workload, and measurement. If leaders treat every post-training report spike as a breach signal, they will overstate risk and may wrongly judge the campaign a failure. If they dismiss all spikes as noise, they can miss a genuine increase in attack attempts that surfaced because staff became better at spotting them. The useful question is not whether reports rose, but whether the mix shifted toward higher-quality reporting, faster escalation, and earlier containment. Where teams measure awareness success only by report count, the metric is easy to inflate and hard to interpret. Where they pair report volume with validation rate, time-to-triage, and repeat reporting patterns, the picture becomes much clearer. For broader adversary behaviour context, the MITRE ATT&CK Enterprise Matrix helps distinguish common intrusion techniques from the reporting noise a campaign can generate. The guidance breaks down when the organisation lacks a baseline for normal reporting behaviour before the campaign begins.

Where the interpretation goes wrong, and what to watch for

Tighter awareness measurement often increases operational noise, requiring organisations to balance better visibility against heavier triage demand.

One common mistake is assuming that a sudden rise in suspicious reports means attackers have changed tactics. Sometimes they have, but often the real change is that users now notice the same lures they used to ignore. Another edge case is seasonal or event-driven reporting, where reminders, simulations, or policy changes create a short-lived spike that has little to do with live adversary activity. Guidance versus consensus also matters here: there is broad agreement that awareness affects reporting volume, but no universal benchmark for how much of a spike should be treated as training effect versus threat increase.

Another gotcha is metric selection. If an organisation tracks only volume, awareness can look worse after it has improved. If it tracks only confirmed incidents, it may undercount the value of early user reporting that helped analysts prevent escalation. A better read is whether reports are arriving earlier in the attack chain, whether duplicate reports are falling, and whether analysts can trace more events back to a narrower set of real campaigns. That is where awareness becomes operationally useful rather than merely educational.

For practitioners, the most important test is whether the reporting increase is producing cleaner prioritisation. If it is not, the organisation may be seeing more activity without improving its ability to separate genuine threat from heightened attention.

Practitioner Guidance

What to prioritise: compare post-campaign reports against a pre-campaign baseline so leaders can distinguish better detection behaviour from true attack growth. Focus on report quality, triage time, and confirmation rate rather than raw incident counts alone.

What to verify: verify that reporting categories are consistent. If users, service desk staff, and analysts use different labels for the same event, awareness data will exaggerate movement that is really just taxonomy drift.

Decision rule: treat a spike as improved visibility unless there is independent evidence of new attacker infrastructure, new lure patterns, or a rising confirmation rate. If those corroborating signals are absent, do not present the spike as breach growth.

Practitioner takeaway: awareness campaigns should be judged by how well they improve signal quality, not by whether they make the inbox look busier.

Related resources from NHI Mgmt Group

• Why do AI-driven vishing attacks make static awareness training less effective?
• Why do legitimate admin tools make identity attacks harder to detect?
• Why do non-human identities make supply chain attacks harder to contain?
• Why do AI-driven phishing attacks make passwordless authentication more important?