A security awareness plateau is the point at which training activity continues but employee behaviour stops improving. It usually appears after early rollout gains fade, showing that the programme is measuring participation more effectively than it is changing human decision-making under attack pressure.
What a security awareness plateau means
A security awareness plateau is not a failure to train, but a failure to keep improving behaviour. It usually means the programme has reached the limits of passive instruction, and that the organisation is no longer changing how people actually decide under pressure.
At that point, training completions and attendance can still rise while real-world resilience stays flat. The useful question shifts from “did people take the course?” to “are people making safer choices when confronted with phishing, impersonation, urgency, or unfamiliar requests?”
Why the plateau happens
Plateaus usually appear when awareness activity is too generic, too infrequent, or too detached from the threats employees actually face. Repetition can create familiarity without improving judgement, especially when content stays focused on policy reminders instead of realistic decision-making.
Another common cause is metric drift. A programme can look healthy if it tracks participation, quiz scores, or completion rates, even though those measures say little about behaviour change. That creates the appearance of progress long after the easy gains have faded.
How to recognise that training has stopped changing behaviour
The clearest signs are stable or rising training participation paired with flat phishing resilience, unchanged report rates, repeated risky actions, or persistent weaknesses in the same user groups. If the same people keep making the same mistakes, the programme is probably measuring exposure to content more than learning transfer.
Plateaus also show up when incident patterns do not move even after multiple campaigns. If awareness emails, simulations, and mandatory modules are all running, but user decisions remain predictable under pressure, the issue is usually relevance, reinforcement, or context rather than volume.
For a practical reference point on programme design, see the Security Awareness and Human Risk Management Guide, which focuses on behaviour change, human risk scoring, and awareness metrics.
What a plateau means for programme design
A plateau is often a sign that the organisation needs to shift from broad awareness to targeted human risk management. That means aligning training to observed behaviours, attack patterns, role-based exposure, and business context instead of repeating the same generic content for everyone.
It is also a sign to treat awareness as one control in a wider security model, not as a standalone defence. Programmes improve when messaging, simulations, reporting mechanisms, culture, and leadership reinforcement work together rather than operating as isolated campaigns. The Security Awareness Training Buyer's Guide is useful here because it frames evaluation around capability, integrations, and proof of behavioural value, not just content delivery.
Threat patterns matter too. For example, QR-based phishing can bypass habits that standard email examples do not address, so the content mix must evolve with the attacker’s method. The QR Code Phishing (Quishing) Guide is a useful reminder that awareness has to follow the attack surface, not just the annual training calendar.
Risk and Threat Considerations
A plateau matters because it can create false confidence. Leadership may assume the workforce is improving while attacker-facing behaviours remain unchanged, which leaves the organisation exposed to phishing, impersonation, and social engineering that exploits routine habits rather than technical flaws.
Failure mechanism: The programme optimises for visible activity, such as attendance and completion, instead of reinforcing recognition, judgement, and response under realistic attack conditions. Over time, that weakens the organisation’s ability to spot when people are still likely to click, comply, or disclose information.
Impact: The organisation keeps spending on awareness without materially reducing human-driven incident likelihood, and the same behavioural weaknesses remain available to attackers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | This term concerns the effectiveness of awareness and skills training as a security safeguard. |
| Recommendation — Measure training by behaviour change and tune awareness activities to the threats users actually face. | ||
| NIST CSF 2.0 | PR.AT-01 — All personnel are provided cybersecurity awareness education and are informed of their cybersecurity responsibilities | A plateau shows awareness education must translate into sustained responsibilities and safer decisions. |
| GV.OV-01 — Results of the cybersecurity risk management strategy are used to inform and improve the program and risk management strategy | A plateau is a feedback signal that the programme needs to be adjusted using performance results. | |
| Recommendation — Link awareness content to observable responsibilities and review whether it changes user behaviour. Use behavioural results, not attendance alone, to revise the awareness programme. | ||
Practitioner Guidance
What to watch for: Treat a plateau as a measurement problem as much as a training problem. If your metrics cannot show whether risky decisions are declining, your programme may be succeeding administratively while failing operationally.
Governance implication: Owners should define success in terms of behaviour change, not programme activity. That usually means using role-sensitive content, more realistic simulations, and metrics that connect training to actual risk reduction rather than simple participation counts.
Practitioner takeaway: When awareness stops moving behaviour, the answer is rarely “more training.” It is usually better targeting, better measurement, and better reinforcement.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org