Why do awareness campaigns often fail to change employee behaviour?

Why This Matters for Security Teams

Awareness campaigns often miss the point because behaviour does not change when people are told to “be careful.” It changes when the environment makes the safe action easy, immediate, and visibly rewarded. NHI Management Group research on the State of Secrets in AppSec shows a persistent gap between confidence and outcomes: leaked secrets can take an average of 27 days to remediate, while only 44% of developers consistently follow secrets best practices. That pattern is a warning for awareness programs too. If the message is generic, detached from the actual event, and followed by no operational consequence, employees learn to ignore it. The same problem appears in broader governance work under the NIST Cybersecurity Framework 2.0, where awareness is only useful when it supports measurable protective behaviour, not just completion metrics. In practice, many security teams encounter this only after repeated user reporting failures have already normalized the wrong response.

How It Works in Practice

Effective behaviour change starts with feedback that is specific to the incident the employee actually experienced. If someone reports a phishing email, the follow-up should explain what made that message suspicious, what happened next, and what the user should do differently next time. That is more effective than a generic annual module because it links recognition to consequences. Practitioner guidance usually works best when it is paired with simple operational mechanics:

• Use report-and-response loops so the employee sees that reporting leads to action.
• Rewrite feedback in plain language, not policy language.
• Base simulations on current threat themes, not stale templates.
• Measure reporting quality, speed, and follow-through, not just click rates.
• Close the loop with managers and service owners when the issue is recurring.

This approach aligns with the NIST Cybersecurity Framework 2.0 emphasis on governance and protective behaviour, and it matches the operational lessons seen in the DeepSeek breach, where exposed sensitive data demonstrates how quickly real attackers exploit weak discipline around secrets and access. The goal is not to make staff “security experts,” but to make the right response routine and friction-light. These controls tend to break down in large, distributed organisations with fragmented reporting channels because employees receive inconsistent feedback and never see a single, trustworthy remediation path.

Common Variations and Edge Cases

Tighter awareness programs often increase operational overhead, requiring organisations to balance relevance against message fatigue. That tradeoff matters because over-simulating every threat can make employees numb, while under-simulating leaves them unprepared. Current guidance suggests the best campaigns are targeted: high-risk roles get role-specific scenarios, while the broader workforce gets short, repeatable coaching tied to common attacks. There is also no universal standard for how fast feedback must arrive, but the practical rule is clear: the longer the delay, the weaker the behaviour change. If the employee reports a suspicious message and hears nothing for weeks, the training effect decays. Likewise, if leadership punishes honest reports or frames every mistake as a failure, people stop reporting early. That turns an awareness program into a compliance exercise. The strongest programs treat awareness as part of a detection and response loop, not a standalone curriculum. They also recognize that some behaviours are structural, not educational. If users keep bypassing controls because the workflow is too hard, training alone will not fix it. In those cases, process design and control tuning matter more than repetition.

Related resources from NHI Mgmt Group

• Why do broad awareness campaigns often fail to change security behaviour?
• How do you know if a security awareness programme is actually changing behaviour?
• Why do ServiceNow tickets leak secrets so often?
• Why do consumer IDV tools often fail in employee onboarding and helpdesk recovery?