Why your awareness programme is not working

Almost every organisation runs security awareness training. Almost every organisation is still compromised through people. Both things are true at once and the reason is not that people are careless.

Annual awareness training is designed to be completed, not to be difficult. It is measured on completion rate because completion rate is the number an auditor asks for. The result is a programme optimised for a metric that has no relationship to whether anybody would spot a well made phishing email at four o'clock on a Friday.

What an attacker actually exploits

Real intrusions do not rely on somebody being ignorant. They rely on somebody being busy, being deferential to apparent authority, and operating inside a process that makes the wrong action easier than the right one. An invoice change request that arrives during month end from somebody who sounds like the CFO is not defeated by knowing what phishing is.

That means the useful unit of training is not the individual, it is the decision point. Who can change bank details, what do they check, and does that check survive somebody senior being impatient? Train the process and the people in it together, and the awareness follows.

Reporting is the metric that matters

The number worth tracking is not how few people clicked. It is how many reported, and how fast. An organisation where the first person to spot something tells somebody within minutes is resilient even when people do click, and one where nobody reports is fragile even when the click rate looks good.

That reframing changes what the training has to achieve. It has to make reporting feel safe and normal rather than like an admission. Which means the tone cannot be the tone of a test somebody can fail.

The uncomfortable implication

If reporting is the metric, then punishing people who click is directly counterproductive, and a simulated phishing programme that names and shames is training people to stay quiet. Several organisations run both at once and wonder why their reporting rate is flat.