Almost every enterprise today mandates some form of security awareness training for its workforce. It has become a standard component of corporate governance, an annual ritual designed to fortify the human element against the persistent tide of cyberattacks. Yet, despite years of investment, increased completion rates, and the proliferation of sophisticated training platforms, the efficacy of these programs remains a subject of intense debate. Empirical evidence suggests a troubling disconnect: even as training programs become more ubiquitous, successful social engineering attacks continue to rise, leaving many to wonder if we are merely going through the motions.
The discourse surrounding this issue spans a wide spectrum. Some critics argue that traditional awareness training is fundamentally broken and obsolete, while others maintain it remains a necessary, albeit flawed, component of a defense-in-depth strategy. Between these poles lie the nuanced perspectives of those who argue that success "depends" on how the training is delivered, the frequency of engagement, and the integration of behavioral psychology. At its core, the training aims to achieve two primary objectives: minimizing the impact of human error—which can turn a well-meaning employee into an inadvertent insider threat—and hardening staff against the increasingly sophisticated tactics of malicious social engineers.
The Problem of Compliance Theater
A pervasive concern among security professionals is that many awareness programs have devolved into "compliance theater." This phenomenon occurs when the primary goal of the training shifts from genuine behavioral change to the satisfaction of regulatory, legal, or insurance requirements.
Stefan Dasic, a senior malware research engineer at Malwarebytes, points to the structural flaws in how these programs are implemented. "Most training programs fail because of how they’re run," he explains, noting that the content is often repetitive, generic, and disconnected from the daily realities of the employees. This repetition is frequently not the result of poor design, but rather a byproduct of rigid compliance mandates that force the same content upon the entire workforce year after year, regardless of an individual’s existing knowledge or role-specific risk profile. When training is reduced to an annual legal checkbox, it ceases to be an educational tool and becomes an administrative burden.
Robert Costello, chief digital and information officer at Merlin Group, echoes this frustration, noting that modern training often fails to account for the rapid evolution of threat actors. "Too much of today’s training is compliance-focused and doesn’t reflect the sophisticated social engineering and AI-enabled attacks organizations face today," Costello says.
This sentiment is shared by Mike Lyman, a senior security consultant at Black Duck. Lyman argues that the act of re-taking identical courses across different employers is the ultimate hallmark of compliance theater. Such programs prioritize "checkbox completion" over actual behavioral transformation, which helps explain why researchers often find weak or null effects on security outcomes, even in organizations with near-perfect training completion rates. The fundamental issue is that compliance standards often establish a ceiling—a target to be met—rather than a baseline that organizations are encouraged to surpass through continuous improvement.
Where and When Training Works
Despite the criticism, experts generally agree that security awareness training still holds value, provided it is deployed correctly. Drew Thompson, global lead for training and enablement at UltraViolet Cyber, suggests that training is effective, but primarily within the narrow scope of the specific situations it covers. The inherent challenge is that the threat landscape is fluid. "The attackers keep changing what they are doing, and the training is often trying to prepare people based on what we already know," Thompson observes.
Josh Bartolomie, VP and global head of threat intelligence at Doppel, agrees that awareness is still a vital component of defense, but cautions against the common mistake of expecting it to solve problems that have fundamentally shifted. For training to be effective, experts argue it must be more frequent, more reflective of evolving attack vectors, and more closely tied to the specific roles employees play within the business.
Critically, there is a growing consensus that awareness training cannot stand alone. It must be supported by robust technical controls, clear identity verification procedures, and sound business processes. As Biswajit De, co-founder and CTO at CleanStart, succinctly puts it, "Awareness should complement engineering, not replace it. Good engineering assumes things will fail, and good security should assume people occasionally will too." In this view, security awareness should reinforce a modern security architecture, not serve as a crutch to compensate for a lack of one.
The AI-Driven Threat Landscape
The urgency of this debate has been magnified by the rise of generative AI. Jim Dolce, CEO at Lookout, argues that traditional training is "fundamentally outmatched" by today’s mobile-centric AI threat landscape. The historical aspiration to turn employees into a "human firewall" is increasingly viewed as a relic of the desktop-centric era.
Frontier AI models have weaponized social engineering, enabling attackers to generate hyper-personalized, flawless phishing attempts and voice clones at machine speed across mobile channels like SMS, WhatsApp, and messaging apps. "Security awareness training fails because we are asking humans to defeat AI on a 6-inch phone screen," says Dolce. "You cannot train away a structural architectural problem."
Mike Aalto, co-founder and CEO at Hoxhunt, notes a staggering 14-fold surge in AI-generated phishing observed between 2025 and 2026. According to Aalto, the shift isn’t necessarily about brand-new, exotic tactics, but rather the modernization of classic attacks. Traditional phishing kits are being upgraded with cleaner formatting, superior writing, and highly personalized messaging that can be generated at scale.
Aalto advocates for a shift toward "behavioral" training, which focuses on rewarding measurable, positive actions like reporting threats and utilizing multi-factor authentication (MFA). By moving away from fear-based tactics and toward continuous, automated interventions, organizations can transform their workforce into an active, intelligent sensor network capable of catching threats that automated systems might miss.
The Asymmetry of the Modern Attack
The struggle against social engineering is defined by a brutal asymmetry. As the adage goes, "Defenders must be right every time; attackers only need to be right once." To defend against the current wave of AI-assisted social engineering, every individual employee must be vigilant, accurate, and correct in every decision, every time, at machine speed.
"Attackers don’t need everyone to fail," explains Biswajit De. "They just need one distracted person on one busy afternoon." This is compounded by the challenge of predicting future attacks. Because training is largely limited to teaching employees how to recognize known patterns, it is inherently reactive. By the time a new attack methodology is identified and incorporated into a training module, the attackers have likely moved on to a new strategy.
Furthermore, there is the psychological reality of the human element. Can a professional whose daily life revolves around bean-counting or administration be expected to maintain the same level of suspicious scrutiny as a career cybercriminal whose sole focus is deception?
The Psychology of Awareness
To better understand the limitations of training, it is helpful to look at cognitive psychology. Jordan Richard Schoenherr, a scientist at Humanix and an adjunct professor at the University of New South Wales, emphasizes that "forgetting, or entropy, is the default state of memory," and it occurs rapidly. Even if training is successful in the short term, there is no guarantee that an employee will be able to recall the correct behavioral response in the heat of a high-pressure, real-world situation.
Schoenherr notes that the mental models employees use to evaluate whether a communication is valid are based on analogical reasoning—comparing current stimuli against long-term memory. If an employee is trained to look for specific "flags," such as spelling errors in a classic scam, they may interpret the absence of those specific errors as proof of legitimacy.
Predicting the future of these attacks is possible, but difficult. It requires "decision-making under deep uncertainty," a process that involves modeling various scenarios based on available variables. While organizations can use these models to better prepare their staff, it remains an imperfect science. "People will always be fighting the last war," Schoenherr says, "and are not necessarily capable of thinking what will happen in the future."
Ultimately, while understanding the psychology of cognition cannot bridge the inherent asymmetry of the security threat, it provides a roadmap for more effective training design. By combining behavioral conditioning, high-frequency refreshers, and advanced technology, organizations can move toward a more resilient posture. Awareness training will never be a panacea, and it will never be perfect, but it remains an essential layer of defense—one that must be continuously refined to keep pace with the evolving ingenuity of the adversary.
