Security awareness training in its annual form showed no significant link to phishing failures in a study of over 19,500 employees. Verification built into workflows and easy reporting do more.
Security awareness training, in the annual form most companies run, shows little measurable effect on whether employees fall for phishing. A 2025 study of over 19,500 employees found no significant link between recent training and failure rates. What changes behavior is how work is designed: verification built into workflows, reporting that is easy and blame-free, and short sessions tied to real roles.
That does not make training pointless, and in Massachusetts it is not optional. It means the hour of slides is the smallest part of the job. I study behavioral psychology, and the findings below line up with what that field would predict about attention, habit, and the moment of decision.
Researchers from UC San Diego and UC San Diego Health ran an 8-month randomized controlled experiment with ten simulated phishing campaigns sent to over 19,500 employees, published at IEEE Security and Privacy in 2025. On annual training, their finding was direct: "no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation."
Embedded training, the short lesson shown right after someone clicks a simulated lure, did slightly better. Compared with the control group, it lowered the failure rate by 1.7 percentage points. The authors concluded that anti-phishing training programs, "in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks."
Engagement explains part of it: most people clicked through the training quickly and moved on. Over the eight months, more than half of employees failed at least one simulation. Repeated exposure kept finding new people on new days.
An earlier study from ETH Zurich, also published at IEEE Security and Privacy, ran for 15 months with more than 14,000 employees of one company. Its conclusion was that embedded training "as commonly deployed in the industry today, does not make employees more resilient to phishing, but instead it can have unexpected side effects that can make employees even more susceptible to phishing."
That fits the pattern described in risk compensation. When people believe a safety layer is catching mistakes for them, some of them relax. A training banner after a simulated click can quietly teach that the system will tell you when something was a test, which is the opposite of the habit you want.
Less than most dashboards suggest. Verizon's 2026 Data Breach Investigations Report found that phishing simulations sent by voice and text drew a median click rate about 40% higher than email simulations. Verizon describes the non-email sample as small, so treat the comparison as directional.
A falling click rate is easy to produce and hard to interpret. A program can move the rate by choosing easier lures, sending fewer tests, or timing them well, without changing what happens when a real request lands. That is the trap described in why your team games every metric: once the click rate becomes the target, it stops telling you about risk.
A more useful measure is how quickly real suspicious messages get reported, and what happens to them afterward. A report that reaches someone who acts on it within minutes is worth more than a quarter of clean simulation results.
Three things, each of which moves the decision out of one person's head and into the process.
Verification built into the workflow. If a change to bank details cannot be paid until someone calls the vendor back on a number already on file, the employee does not need to spot the fake. The control does the spotting. This is the core defense against business email compromise, and it is an example of the case for friction in the right place.
Easy, blame-free reporting. One button or one address, a fast human reply, and no penalty for reporting something that turns out to be fine. People who fear looking foolish delay, and delay is where losses grow. What to do with a suspicious email and how to check if a message is a scam give staff a concrete next step instead of a vague warning.
Short, role-specific sessions. Accounts payable, HR, and whoever runs the company's social accounts each receive different requests. Fifteen minutes on the exact messages a role sees, with the exact check the company expects, respects people's time and gives them something to use. Building a security culture covers why this lands better than a company-wide module.
Yes, for any business that owns or licenses personal information about Massachusetts residents. Under 201 CMR 17.03(2)(b)1, the written information security program must include evaluating and improving the effectiveness of safeguards, "including but not limited to: 1. ongoing employee (including temporary and contract employee) training." Section 17.04(8) separately requires "education and training of employees on the proper use of the computer security system and the importance of personal information security."
Two words in that text are worth noticing. "Ongoing" means more than an onboarding module. "Contract" means the temps, contractors, and agency staff who touch the same records. The full program is covered in Massachusetts WISP requirements under 201 CMR 17.
The research above is a reason to make that training useful. A program built around real requests, real checks, and easy reporting meets the requirement and gives the business something that holds up when it matters.
At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so. We also run remote team sessions on exactly this: the requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.
In its common annual form, the evidence says very little. A 2025 study of over 19,500 employees found no significant relationship between recent training and phishing simulation failures. Embedded training lowered failures by 1.7 percentage points.
A 15-month ETH Zurich study of more than 14,000 employees found that embedded training as commonly deployed did not make employees more resilient and could make them more susceptible to phishing.
There is no reliable universal benchmark. Verizon's 2026 DBIR found voice and text simulations drew a median click rate about 40% higher than email simulations, from a small sample, and any rate moves with how hard the lures are. Track your own trend and your reporting speed instead.
Yes. 201 CMR 17.03(2)(b)1 requires ongoing employee training, including temporary and contract employees, for businesses that own or license personal information about Massachusetts residents.
What is quishing? Phishing hidden in a QR code, so nobody can read the link before scanning. The FBI warned in January 2026 that quishing pushes victims from work computers to phones, past email security controls.
How to check if a message is a scam, in six steps that work for email, texts, calls, DMs and websites, including a safe way to ask an AI assistant. The FTC says people reported $15.9 billion in fraud losses in 2025.
What to do with a suspicious email at work: five steps for staff and three things the company needs first. The FBI logged 191,561 phishing and spoofing complaints in 2025, more than any other crime type.
Work With Us
Kief Studio builds, protects, automates, and supports full-stack systems for businesses up to $50M ARR.
Newsletter
Strategy, psychology, AI adoption, and the patterns that actually compound. No spam, easy to leave.
Subscribe
