Ask a security team whether their organization does security awareness training, and almost all of them say yes. Ask whether it's actually reduced the number of people clicking phishing links, and the answer gets noticeably quieter. Most annual training satisfies the checkbox — a module, a quiz, a completion certificate — without measurably changing behavior.
That's not because people are careless. It's because the training was designed to produce a compliance record, not a safer habit, and those two goals turn out to require genuinely different programs.
The tell-tale signs of compliance theater
- It happens once a year. Behavior doesn't get reinforced by an event twelve months apart; it decays within weeks of any single session, long before the next one is even scheduled.
- It's generic. A phishing example about a fake shipping notification doesn't prepare someone for the specific, targeted email impersonating their actual CFO's writing style, sent at the exact moment a real invoice was expected.
- The quiz tests recall, not judgment. Knowing the definition of phishing and correctly identifying a suspicious email in a live inbox, mixed in among forty legitimate ones, are different skills. Most training only measures the first.
- Nobody ever finds out what happens after. Training that isn't followed by real (simulated) phishing attempts, with real feedback, has no way of knowing whether anything actually changed — the program runs, the certificates get filed, and the actual click rate stays whatever it always was.
What reduces risk instead
- Realistic, ongoing simulation — not a single annual test, but periodic, varied phishing simulations that reflect the specific tactics targeting your industry, with immediate, private, non-punitive feedback when someone clicks. The feedback matters as much as the simulation itself: a click followed by public shaming teaches people to hide mistakes, not to report them.
- Role-specific training. Finance teams face business email compromise, often targeting a specific approval workflow. Engineers face credential-stuffing and dependency risks, an entirely different threat model. A single generic module serves neither group well, because it has to stay vague enough to apply to both.
- A safe reporting culture. The single biggest lever most organizations underuse: making it normal, fast, and blame-free to report "I think I clicked something I shouldn't have." Fear of embarrassment is what turns a five-minute incident — reported immediately, contained quickly — into a three-week one, discovered only after real damage has already spread.
- Leadership visibly participating. When executives skip the training or treat it as beneath them, that signal reaches the rest of the organization faster than any policy document does. A CEO who's visibly gone through the same simulated phishing test as everyone else sends a message no slide can.
The honest measure of success
A security awareness program is working if your click rates on simulated phishing drop over time and — just as importantly — if your reporting rates go up. An organization where more people report suspicious activity, even if a few more people click on things, is in a stronger position than one where fewer people click but almost nobody would ever admit it if they did. The second organization's real risk is invisible, sitting in unreported incidents nobody's tracking; the first organization's is measured and shrinking.
What this looks like when it's actually built well
The organizations that get this right tend to treat the simulation program the way they'd treat any other operational metric with a target and an owner: a monthly or quarterly cadence, varied enough that people can't simply recognize "the test email" by now-familiar formatting, and a short debrief after each round that goes to managers, not just a security dashboard nobody outside the security team ever opens. The debrief matters more than the simulation itself in one specific way — it's the mechanism that actually connects "we ran a test" to "here's what changed as a result," which is the exact link compliance theater never builds.
If your current program can't tell you either number, it isn't measuring security. It's measuring attendance — and attendance was never the thing that was actually at risk.