Why Most Security Awareness Training Doesn’t Change Behaviour

Most security awareness training does help. It raises awareness and it gives people a basic understanding of common threats. But in most businesses, it still doesn’t really do the one thing that matters most: change behaviour.

And it’s usually not because the content is wrong. It’s because it’s too generic.

People are busy. They’ve got full inboxes, deadlines, meetings, and constant distractions. So when training feels disconnected from their actual day-to-day work, it’s easy for it to become something to get through.

Over time, it turns it into a box-ticking exercise instead of something that really makes an impact.

The Issue with One-Size-Fits-All Training

Most businesses still rely on broad training that tries to cover everything at once. And while that makes sense from a delivery point of view, it often misses what’s actually happening.

You get general advice like “watch out for phishing emails” or “don’t click suspicious links,” but that doesn’t always translate into how you’ll really be targeted.

And that matters, because modern attacks aren’t generic anymore.

The Reality: Attacks Are Highly Targeted

Cyber criminals don’t send the same message to all businesses.

So for example:

Finance teams might see an invoice  that looks like it’s from a real supplier.

HR teams might get emails from fake candidates with malicious attachments.

Senior leaders are constantly impersonated with a view to pressure staff in to doing something they shouldn’t.

And within each of these examples, the tactics used are different. Fraudsters tailor their approach based on roles, responsibilities, and how a business actually operates.

That’s why generic training often falls short. It doesn’t reflect what people are actually up against.

From Awareness to Action

Security awareness training shouldn’t just be about awareness. It should be about behaviour.

And behaviour changes when people can actually relate what they’ve learned to what they’re doing at work. When training feels relevant, engagement increases. People are more likely to pay attention, ask questions, and when it comes to it, pause before acting.

And those small moments of hesitation are so often what make the difference between stopping an attack and falling for one.