Ask a security team whether their organization does security awareness training, and almost all of them say yes. Ask whether it's actually reduced the number of people clicking phishing links, and the answer gets noticeably quieter. Most annual training satisfies the checkbox — a module, a quiz, a completion certificate — without measurably changing behavior.
That's not because people are careless. It's because the training was designed to produce a compliance record, not a safer habit.
The tell-tale signs of compliance theater
- It happens once a year. Behavior doesn't get reinforced by an event twelve months apart; it decays within weeks of any single session.
- It's generic. A phishing example about a fake shipping notification doesn't prepare someone for the specific, targeted email impersonating their actual CFO's writing style.
- The quiz tests recall, not judgment. Knowing the definition of phishing and correctly identifying a suspicious email in a live inbox are different skills. Most training only measures the first.
- Nobody ever finds out what happens after. Training that isn't followed by real (simulated) phishing attempts, with real feedback, has no way of knowing whether anything actually changed.
What reduces risk instead
- Realistic, ongoing simulation — not a single annual test, but periodic, varied phishing simulations that reflect the specific tactics targeting your industry, with immediate, private, non-punitive feedback when someone clicks.
- Role-specific training. Finance teams face business email compromise. Engineers face credential-stuffing and dependency risks. A single generic module serves neither group well.
- A safe reporting culture. The single biggest lever most organizations underuse: making it normal, fast, and blame-free to report "I think I clicked something I shouldn't have." Fear of embarrassment is what turns a five-minute incident into a three-week one.
- Leadership visibly participating. When executives skip the training or treat it as beneath them, that signal reaches the rest of the organization faster than any policy document does.
The honest measure of success
A security awareness program is working if your click rates on simulated phishing drop over time and — just as importantly — if your reporting rates go up. An organization where more people report suspicious activity, even if a few more people click on things, is in a stronger position than one where fewer people click but almost nobody would ever admit it if they did.
If your current program can't tell you either number, it isn't measuring security. It's measuring attendance.