Why Cybersecurity Training Doesn't Always Change Employee Behaviour

Cybersecurity awareness training is part and parcel of any good enterprise security programme. It helps employees identify phishing attempts, manage sensitive information, develop strong passwords and report suspicious activity.

But if security oversights continue to happen over and over, the problem may not be the training itself, but rather whether the training is addressing the right issues in the right way.

Employees can pass all the modules and the final assessment but have difficulty applying what they have learnt in real life situations. This may indicate gaps in understanding, problems applying security principles to new, unexpected situations, or workplace conditions that are making it difficult to make secure decisions.

For example, an employee who repeatedly misuses sensitive information may need more explicit instructions on data protection standards. Another employee may know what the requirements are but might find it difficult to apply them when under work pressure. In this case, practical exercises related to their role may be helpful. Sometimes the problem is workplace expectations or processes that make it harder to take the secure option.

The key to cybersecurity training effectiveness is to figure out WHY mistakes are continually happening. And the answer might not be more training.

By establishing the difference between simple knowledge gaps, applying what has been learned and the pressures of work, organisations can identify where their training programmes fall short.

Knowledge Doesn’t Always Translate Into Action

Traditional cybersecurity training often consists of transferring information to employees through lessons and examples, and then applying assessments to see if the information has been retained. These techniques can determine whether or not employees truly understand security principles, but unfortunately it only provides part of the picture of cybersecurity training effectiveness.

The key question for security teams is what the assessment results mean about a programme’s strengths or weaknesses. If employees are often confused about certain topics, it could be a sign that the content needs to be clarified, or that certain risks need more attention. But high scores on tests shouldn’t be considered definitive proof that training is truly preparing employees to make the security decisions they will be faced with at work.

By considering assessment results along with incident data, simulation results and common errors organisations can spot areas that may need further investigation or focused training.

Simulated Phishing Tests Don’t Tell the Whole Story

Simulated phishing exercises help security teams assess how employees respond to suspicious emails. However, when employees fail a simulation, the result does not automatically explain what went wrong or which training intervention would be most effective.

An employee might click a link because they do not recognise common phishing indicators, struggle to assess a convincing message or have difficulty applying security guidance in a realistic situation. Each points to a different potential weakness, requiring a different response. The first may require more clear-cut guidance, while the second or third may benefit from practical exercises that allow employees to assess more complex situations.

The difficulty of the simulation itself is also important. The National Institute of Standards and Technology (NIST) has developed the Phish Scale, which is a means of quantifying how difficult it is for recipients to identify a phishing email.

Research from this shows that click rates shouldn’t be considered in isolation as a measure of the cybersecurity training effectiveness. It should rather be viewed in relation to the email’s characteristics and how relevant it is to the target audience.

A high click rate on a very convincing simulation might warrant a different response than a high click rate on an email with more obvious warning signs. Similarly, a low click rate on a phishing email that’s easy to spot doesn’t prove that employees can spot more sophisticated threats.

Security teams should use the results of the simulations to determine where additional investigation is required rather than automatically responding to each failed test by simply providing more training.

Organisations can review the exercise’s level of difficulty, the types of mistakes made, and the explanations employees give for the decisions they made. This can help determine whether they need to address knowledge gaps, develop more practical judgement, or explore additional factors that may be affecting training outcomes.

Different Results May Equal Different Training Needs

Poor results can also mean that employees haven’t been trained to make the decisions that their jobs call for. A finance team member may know the general advice on phishing, but be less able to judge a plausible supplier payment request.

This points to a possible practice gap, rather than necessarily a lack of basic knowledge. Implementing role-specific scenarios in security training can help investigate where that gap lies, but it shouldn’t be assumed that it will resolve on its own.

Diagnose the Problem Before Repeating Training

When employees continue making security mistakes, repeating the same awareness module may not address the cause. Security teams first need to establish whether the issue is a knowledge gap, difficulty applying existing knowledge or working conditions that make the expected action difficult to take.

A knowledge gap may call for clearer instruction. If employees understand a rule but struggle to apply it to unfamiliar or convincing scenarios, they may need targeted practice and feedback. If the correct action is understood but time pressure, conflicting expectations or limited authority make it difficult to follow, more training alone is unlikely to resolve the problem.

Feedback should explain what made a response risky, which information mattered and what a more appropriate action would have been. Security teams can then adjust the intervention to the weakness identified, rather than automatically assigning another general refresher course.

These differentiations line up with NIST's guidance in their Building a Cybersecurity and Privacy Learning Program, which recommends continuously evaluating and improving learning programmes over time.

Use Results to Identify What Needs Improving

Training completion rates indicate whether employees have finished the required training, while assessment scores show how well they performed in tests based on their understanding.

However, neither of the above metrics demonstrate how effectively employees can apply what they’ve learnt or explain why security mistakes persist. Identifying the underlying causes is essential to determining what needs to change to improve training outcomes.

Security teams should interpret available evidence together to identify the likely cause of weak results. Repeated errors on a specific topic may point to a knowledge gap; difficulty with realistic scenarios may indicate a need for practice; and recurring mistakes despite demonstrated understanding may warrant checking whether workplace conditions are obstructing the expected response.

Useful evidence can include:

• Phishing reporting behaviour: Are employees reporting suspicious messages through the appropriate channels, including those that do not form part of a simulation?
• Response to realistic situations: Are employees able to recognise risks and choose suitable actions when they are faced with situations that are relevant to their jobs?
• Same mistakes, different day: Are the same employees or teams running into the same problems even after receiving targeted guidance?
• Confirmed security incidents: Do real-life security incidents show a recurring weakness that training could reasonably address?
• Cementing long-term behaviour: Are the improvements maintained long after a training session or simulation?

Interpret each measure carefully. An increase in employee reports of suspicious activity may indicate better recognition and reporting; an increase in confirmed security incidents is a different measure and should not be interpreted in the same way. Simulation results should also be considered alongside scenario difficulty and the type of mistake made.

Establishing a baseline and comparing results before and after an intervention can help show whether the change appears to be working. It doesn’t show that training caused the improvement. Workplace conditions, threat patterns and other changes may also affect the results.

The purpose of evaluation is to use evidence to identify the likely cause of a problem, select an appropriate response and review whether that response appears to improve outcomes.

Understand the Cause, Improve The Training

Cybersecurity training is more likely to improve security outcomes when organisations understand why mistakes persist before deciding what needs to change.

The issue may stem from gaps in knowledge, difficulty applying what employees know or workplace conditions that make secure behaviour harder to achieve. Each requires a different response, and additional training is not always the answer.

For security teams, the priority is to use evidence to identify the underlying problem, choose an appropriate intervention and assess whether it is improving training outcomes.

Follow EM360Tech’s Security feed for more insights into cybersecurity training effectiveness and enterprise security