Awareness is not behaviour.

Three independent field studies, covering more than 47,000 employees between them, tested security training the way organisations really deliver it. Their findings are uncomfortable, and consistent.

ETH Zurich, 14,733 employees over 15 months. Lain, Kostiainen and Capkun sent 117,864 simulated phishing emails inside a large organisation.¹A third of staff clicked at least once. The training page shown after a click did not help: people who received it clicked more, not less. Asked about it later, 43% of those who remembered the page said it "made me feel safe". A follow-up study concluded that "phishing is an attention problem, rather than a knowledge one".²

UC San Diego Health, 19,789 employees.In an eight-month randomised trial, Ho and colleagues found "no significant relationship" between recently completing annual awareness training and failing a phishing test.³ Training shown after a mistake cut the failure rate by just 2%. More than half of training sessions ended within 10 seconds, and fewer than 24% of people finished the material.

A US fintech, 12,511 employees.Rozema and Davis found training had no significant effect on clicks or on reporting, with "negligible effect sizes".⁴ The difficulty of the lure, on the other hand, doubled the click rate.

None of this says people cannot learn. Smaller controlled studies show real gains, especially when practice is repeated: a German public-sector study of 409 employees found people got better at spotting phishing for four months, and the gain had faded by six, while reminders using videos and interactive examples held for at least another six months.⁵ The lesson is narrower and more useful. Content delivered once a year, or as a lecture after a mistake, does not reliably change what people do. The same studies point to what does.

Verizon's 2026 Data Breach Investigations Report found the human element present in 62% of breaches, up from 60% the year before.⁶That is not the same as "human error": the category includes social engineering and the misuse of stolen credentials. The more telling finding sits beside it. In simulations, people fell for voice and text lures at a rate 40% higher than email, though Verizon's sample for this was small. Pretexting, an invented scenario built to get someone to act, now often arrives by voice.

The money follows. Business email compromise losses reported to the FBI rose to $3.05 billion in 2025, and the FBI now defines the crime to include compromised phone numbers and virtual meeting apps.⁸Complaints mentioning AI passed 22,000, with adjusted losses above $893 million. FinCEN has warned banks about a rise in suspicious activity reports describing deepfake media used to impersonate "an executive or other trusted employee" and instruct large transfers.¹²In Australia, "social engineering / impersonation" was behind 115 of the 404 malicious or criminal data breaches notified in the second half of 2024.³⁸

Behavioural science has a name for the Arup problem: the intention-behaviour gap. A meta-analysis of 47 experiments found that a medium-to-large shift in what people intend to do produced only a small-to-medium shift in what they did.¹⁴ Awareness campaigns work on intention. Attackers work on the moment of action, when people are busy, rushed and talking to someone who sounds senior.

The same literature is clear about what closes the gap, and much of it runs against how training is usually built.

Plans beat intentions

If-then plans ("If a supplier emails new bank details, then I call them on the number already in our system") had an effect of medium-to-large size on whether people reached their goals across 94 tests.¹⁷No trial has tested this on payment fraud yet, but it is the format the FBI's own advice takes: hang up, look up the number yourself, call back.¹³For business email compromise, its first tip is to "use secondary channels" to verify any change to account details.³⁷

Fear works only with a way out

Across 248 samples and more than 27,000 people, fear appeals did change behaviour, and the effect grew when the message included a specific, doable action.¹⁸"Deepfakes are dangerous" is a fear appeal. "Every payment change gets a call to a known number, whoever asks" is a fear appeal with a way out.

Feedback can make people worse

A landmark review of 607 effects found feedback improved performance on average, but more than a third of feedback interventions made it worse, especially when feedback was about the person rather than the task.¹⁶"You failed the test" is about the person. "The sender's domain was one letter off" is about the task.

Spacing and recall beat one long session

Hundreds of experiments show that practice spread over time, and practice that makes people recall rather than reread, outperforms a single block of study.^19,20,21 In one classic study, students who reread material felt more confident but remembered less a week later than those who had been tested. Annual training is the format this research predicts will fade.

Habits take months, not 21 days

In the study most often misquoted on this, the time for a new behaviour to become automatic ranged from 18 to 254 days. Missing a single day did not derail it.¹⁵ A verification reflex is built by many repetitions in the real setting, not by one memorable module.

Change the structure, not just the message

Nudges, small changes to how choices are presented, looked powerful in a meta-analysis of more than 200 studies. After correcting for publication bias, another team found "no evidence for the effectiveness of nudges remains", with structural changes the only category left undecided.^22,23 In security terms: a mandatory callback step, dual approval and a well-placed warning will outlast any poster.

The most hopeful findings in the research are not about avoiding clicks at all. They are about people raising their hand.

In the 15-month ETH Zurich study, employees reported 18,476 suspicious emails and showed "no significant 'reporting fatigue'". ¹ Reports arrived fast: about 10% within five minutes and 30% to 40% within half an hour. In the final five months, staff reports exposed 252 real phishing campaigns comprising 28,830 emails. And one cheap change worked: people who received positive feedback on a report went on to report more. Rewards did not help.²Interviews suggest why. People report mainly out of "the desire to protect and help the organization and coworkers".³⁶

ENISA defines security culture as the knowledge, beliefs, attitudes, norms and values of people about security, and "how they manifest in people's behaviour". ²⁸It also names a poor metric directly: "the number of employees who undertook the training".

The UK's National Cyber Security Centre went further in its 2025 culture principles.²⁴"People need to feel safe from negative repercussions before they will speak up." Incidents are to be "investigated with a view to learn and improve, not to blame", with "no punishment for innocent mistakes", and reporters followed up "to thank them and provide feedback". Its phishing guidance is blunter: "Blaming users for clicking on links doesn't work" and "Employees who are afraid for their jobs will not report mistakes." ²⁵

Aviation learned this decades ago and wrote it into law. European regulation defines a just culture as one where people "are not punished for actions, omissions or decisions taken by them that are commensurate with their experience and training", while "gross negligence, wilful violations and destructive acts are not tolerated".²⁶ That balance matters in finance too: no blame for honest mistakes, no tolerance for skipping a control.

Two more findings anchor the leadership case. Edmondson's study of 51 teams found that psychological safety, not confidence, was what predicted learning behaviour.²⁷And research on security compliance found that top management's participation in security initiatives shaped employees' attitudes, their sense of what peers expect, and their belief that they could comply.²⁹ When the CFO is seen calling a supplier back on a known number, every analyst learns it is allowed to slow a payment down.

Put the evidence together and a different programme emerges. Not more content, but a different design.

Across the markets we work in, the wording has moved from attendance towards effectiveness, social engineering and testing understanding.