Security awareness training, in the annual form most companies run, shows little measurable effect on whether employees fall for phishing. A 2025 study of over 19,500 employees found no significant link between recent training and failure rates. What changes behavior is how work is designed: verification built into workflows, reporting that is easy and blame-free, and short sessions tied to real roles.

That does not make training pointless, and in Massachusetts it is not optional. It means the hour of slides is the smallest part of the job. I study behavioral psychology, and the findings below line up with what that field would predict about attention, habit, and the moment of decision.

Rows of empty folding chairs in a dark training room with a single hot pink light falling across the front row, the gap between security awareness training and behavior — Attendance is easy to measure. Whether anyone acts differently at 4:55 on a Friday is the real test.

Does security awareness training reduce phishing clicks?

Researchers from UC San Diego and UC San Diego Health ran an 8-month randomized controlled experiment with ten simulated phishing campaigns sent to over 19,500 employees, published at IEEE Security and Privacy in 2025. On annual training, their finding was direct: "no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation."

Embedded training, the short lesson shown right after someone clicks a simulated lure, did slightly better. Compared with the control group, it lowered the failure rate by 1.7 percentage points. The authors concluded that anti-phishing training programs, "in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks."

Engagement explains part of it: most people clicked through the training quickly and moved on. Over the eight months, more than half of employees failed at least one simulation. Repeated exposure kept finding new people on new days.

Can phishing training make people more likely to click?

An earlier study from ETH Zurich, also published at IEEE Security and Privacy, ran for 15 months with more than 14,000 employees of one company. Its conclusion was that embedded training "as commonly deployed in the industry today, does not make employees more resilient to phishing, but instead it can have unexpected side effects that can make employees even more susceptible to phishing."

That fits the pattern described in risk compensation. When people believe a safety layer is catching mistakes for them, some of them relax. A training banner after a simulated click can quietly teach that the system will tell you when something was a test, which is the opposite of the habit you want.

A mechanical stopwatch on black velvet with its hand lit hot pink just past the ten second mark, how long most security awareness training sessions actually last — Most people in the UC San Diego study spent less than a minute on the training page.

What do phishing simulation click rates actually tell you?

Less than most dashboards suggest. Verizon's 2026 Data Breach Investigations Report found that phishing simulations sent by voice and text drew a median click rate about 40% higher than email simulations. Verizon describes the non-email sample as small, so treat the comparison as directional.

A falling click rate is easy to produce and hard to interpret. A program can move the rate by choosing easier lures, sending fewer tests, or timing them well, without changing what happens when a real request lands. That is the trap described in why your team games every metric: once the click rate becomes the target, it stops telling you about risk.

A more useful measure is how quickly real suspicious messages get reported, and what happens to them afterward. A report that reaches someone who acts on it within minutes is worth more than a quarter of clean simulation results.

What works better than annual security awareness training?

Three things, each of which moves the decision out of one person's head and into the process.

Verification built into the workflow. If a change to bank details cannot be paid until someone calls the vendor back on a number already on file, the employee does not need to spot the fake. The control does the spotting. This is the core defense against business email compromise, and it is an example of the case for friction in the right place.

Easy, blame-free reporting. One button or one address, a fast human reply, and no penalty for reporting something that turns out to be fine. People who fear looking foolish delay, and delay is where losses grow. What to do with a suspicious email and how to check if a message is a scam give staff a concrete next step instead of a vague warning.

Short, role-specific sessions. Accounts payable, HR, and whoever runs the company's social accounts each receive different requests. Fifteen minutes on the exact messages a role sees, with the exact check the company expects, respects people's time and gives them something to use. Building a security culture covers why this lands better than a company-wide module.

An old brass megaphone resting on its side on a dark counter, glowing under hot pink light, easy no-blame reporting as the alternative to annual security awareness training — Reporting should be as easy as ringing a bell, and it should get the same quick answer.

Is employee security training required in Massachusetts?

Yes, for any business that owns or licenses personal information about Massachusetts residents. Under 201 CMR 17.03(2)(b)1, the written information security program must include evaluating and improving the effectiveness of safeguards, "including but not limited to: 1. ongoing employee (including temporary and contract employee) training." Section 17.04(8) separately requires "education and training of employees on the proper use of the computer security system and the importance of personal information security."

Two words in that text are worth noticing. "Ongoing" means more than an onboarding module. "Contract" means the temps, contractors, and agency staff who touch the same records. The full program is covered in Massachusetts WISP requirements under 201 CMR 17.

The research above is a reason to make that training useful. A program built around real requests, real checks, and easy reporting meets the requirement and gives the business something that holds up when it matters.

A gravel path splitting into two directions at night with one branch lit hot pink, the choice between checkbox security awareness training and workflow design — Ongoing training is the requirement. What that training consists of is the company's choice.

At Kief Studio we build the verification into the systems themselves, so a payment change or a login approval cannot go through on one person's say-so. We also run remote team sessions on exactly this: the requests your staff actually receive and the checks that stop them. In-person sessions in Central Massachusetts are available, scoped in advance. Brian Gagne leads the security engineering; briansgagne.com goes deeper on the technical side.

Frequently Asked Questions

Does security awareness training work?

In its common annual form, the evidence says very little. A 2025 study of over 19,500 employees found no significant relationship between recent training and phishing simulation failures. Embedded training lowered failures by 1.7 percentage points.

Can phishing simulations backfire?

A 15-month ETH Zurich study of more than 14,000 employees found that embedded training as commonly deployed did not make employees more resilient and could make them more susceptible to phishing.

What is a normal phishing simulation click rate?

There is no reliable universal benchmark. Verizon's 2026 DBIR found voice and text simulations drew a median click rate about 40% higher than email simulations, from a small sample, and any rate moves with how hard the lures are. Track your own trend and your reporting speed instead.

Does Massachusetts require security awareness training?

Yes. 201 CMR 17.03(2)(b)1 requires ongoing employee training, including temporary and contract employees, for businesses that own or license personal information about Massachusetts residents.

Behavioral Psychology

Does Security Awareness Training Work?