Reinventing Security Awareness Training
Posted July 25, 2025 by Stacy Hagemann
There was a recent article in Dark Reading titled “We’ve All Been Wrong: Phishing Training Doesn’t Work” by Nate Nelson. It highlights a recent study over an eight-month period evaluating the effects of phishing training, along with previous studies from prior years testing a variety of methods – static, interactive, and simulated training. The conclusion is, it’s having little to no effect.
We see this more as a case of doing the same old thing and expecting a different result. Phishing awareness training came to market in the early 2000s and there has been little to no innovation of how training is delivered or even the topics being covered. You are hard pressed to find any awareness training relating to data loss and AI, both of which are highly relevant in today’s digital world.
The response should not be to say it’s not working, so scrap the training. We should be demanding more innovative and expanded cybersecurity training. The article states interactive training saw improved results, but still not what is expected. While changes within the awareness training market have been slow, we are seeing new solutions with features such as gamifying, personalization to users’ role, and employee ranking to increase competitiveness. Organizations need to take more ownership on training content and delivery, not just phishing, but also on data loss and AI.
Similar to the Cloud Shared Responsibility Model, there should be an Organizational Cybersecurity Shared Responsibility Model. Everyone at the organization should understand their role, the associated risks and be working in their capacity to keep the business safe. When training is done on a more direct and engaging level this not only helps an organizations risk, but also every employee to personally understand their own risk at work and at home.
If you would like more information on Security Awareness Training (SAT), Security Culture and Behavior Programs (SCBP), or User Adaptive Risk Management (UARM), please email us at hello@sayers.com.
