In nearly every modern enterprise, security awareness training has become a ritualistic, annual obligation. From the boardroom to the mailroom, employees are mandated to sit through presentations, watch videos, and click through modules designed to turn them into a "human firewall." Yet, despite the ubiquity of these programs and the billions of dollars flowing into the sector, the tangible benefits remain a subject of intense debate. As successful cyberattacks continue to rise in both frequency and sophistication, the industry is increasingly questioning whether this traditional approach to human-centric security is fundamentally broken.
Empirical evidence suggests a disconnect between the time invested in training and the actual resilience of the workforce. Opinions on the efficacy of these programs span a wide spectrum, ranging from outright dismissal of their utility to cautious optimism, with many experts landing somewhere in the middle—suggesting that while the concept of training is valid, the current execution is failing.
The primary objective of these programs has always been twofold: to minimize the likelihood of an employee becoming an accidental insider threat through poor judgment, and to harden the workforce against the increasingly complex tactics of social engineering. It is in this latter arena—the battle against malicious actors manipulating human psychology—that the debate has reached a fever pitch.
The Rise of Compliance Theater
A prevailing sentiment among cybersecurity professionals is that awareness training, while conceptually vital, has devolved into what is often derisively termed "compliance theater." Stefan Dasic, a senior malware research engineer at Malwarebytes, argues that the failure is rarely a lack of intent, but rather a failure of methodology. "Most training programs fail because of how they’re run," Dasic explains. He points to the repetitive, generic nature of the content as a primary culprit, which often leaves employees feeling that the process is a pointless administrative burden rather than a critical security initiative.
This cycle of redundancy is often not the result of poor design choices by security teams, but rather a byproduct of rigid external pressures. "Some of that repetition isn’t just poor design—a lot of it is driven by compliance and insurance requirements that mandate the same content be re-delivered to every employee every year, regardless of whether they already know it," Dasic notes. When training is reduced to a mandatory legal checkbox, the focus shifts from genuine learning to mere completion.
Robert Costello, chief digital and information officer at Merlin Group, echoes this frustration. He contends that today’s training programs are overly focused on satisfying compliance audits and fail to reflect the reality of the modern threat landscape, where AI-enabled attacks and highly sophisticated social engineering have become the norm. Mike Lyman, a senior security consultant at Black Duck, reinforces this perspective by highlighting the absurdity of employees being forced to retake identical courses when moving between organizations. "It’s the kind of thing that produces checkbox completion without any behavior change," Lyman says, noting that this phenomenon explains why some academic studies continue to find weak or null effects on security outcomes, even in organizations with high training completion rates.
The Limits of Training in a Shifting Threat Landscape
For those who argue that training still has a place, the consensus is that the current model is playing a losing game of catch-up. Drew Thompson, global lead for training and enablement at UltraViolet Cyber, acknowledges that training can be effective for specific, static scenarios. However, he notes the inherent flaw: "The attackers keep changing what they are doing, and the training is often trying to prepare people based on what we already know."
Josh Bartolomie, VP and global head of threat intelligence at Doppel, agrees, stating that while security awareness is still an essential component of a defense-in-depth strategy, organizations are mistakenly expecting it to solve a problem that has fundamentally evolved. The modern consensus among security leaders is that training should be more frequent, highly adaptive, and closely aligned with the specific roles and risks relevant to the employee.
Crucially, experts emphasize that training cannot be a standalone solution. "It needs to be backed by good processes, identity protections, technical controls, and clear verification procedures," Thompson asserts. Biswajit De, co-founder and CTO at CleanStart, adds that security engineering must assume that both technology and humans will occasionally fail. "Good engineering assumes things will fail, and good security should assume people occasionally will too," De explains.
The emergence of "Frontier AI" has further complicated the situation. Jim Dolce, CEO at Lookout, argues that traditional training is fundamentally outmatched by today’s AI-driven threat landscape. The vision of the employee as a "human firewall" is a relic of the desktop-centric era. Today, hyper-personalized, flawless phishing attempts and voice clones are being delivered at machine speed across mobile channels like SMS and WhatsApp. As Dolce puts it, "Security awareness training fails because we are asking humans to defeat AI on a 6-inch phone screen. You cannot train away a structural architectural problem."
Mike Aalto, co-founder and CEO at Hoxhunt, points to a staggering 14-fold surge in AI-generated phishing observed between 2025 and 2026. He notes that the shift isn’t necessarily centered on exotic, never-before-seen tactics, but rather the "modernization of old attacks." Traditional phishing kits are being upgraded with cleaner formatting, superior writing, and highly personalized messaging that can be generated at scale.
Addressing the Asymmetry of Attack and Defense
The struggle to secure the human element is defined by a brutal asymmetry. In cybersecurity, defenders must be successful every single time, while attackers only need to find one success to compromise a system. This challenge is compounded by the fact that the attack is proactive, while the defense is reactive.
Biswajit De highlights the reality of this imbalance: "Attackers don’t need everyone to fail; they just need one distracted person on one busy afternoon." This asymmetry makes the traditional training model—which focuses on teaching recognition of past attacks—inherently limited. If training is limited to known patterns, such as the classic "Nigerian scam" with its tell-tale grammatical errors, the absence of those errors in a modern, AI-generated phish might be misinterpreted by an employee as a sign of legitimacy. As the old security adage goes, the absence of proof is not proof of absence.
The Psychology of Memory and Cognition
To understand why traditional training often fails to stick, the industry is increasingly turning to cognitive psychology. Dr. Jordan Richard Schoenherr, a scientist at Humanix and an adjunct professor at the University of New South Wales, suggests that the primary enemy of security awareness is the nature of human memory itself. "Forgetting, or entropy, is the default state of memory, and it occurs rapidly," Schoenherr explains.
Even when training is successful in the short term, there is no guarantee that an employee will be able to recall the correct behavioral response in the heat of a high-pressure, potentially malicious interaction. Schoenherr advocates for "behavioral nudges" that attempt to reactivate relevant information in the specific context where a decision is being made.
This brings the discussion back to the need for predictive modeling. Schoenherr explains that when we ask employees to judge whether a communication is valid, we are asking them to utilize complex executive functions—drawing on long-term memory to construct a mental model of the situation. While humans can be effective at short-term predictions based on current variables, they are notoriously poor at long-term forecasting, especially when new variables are introduced.
Towards a New Philosophy of Human Security
If security awareness training is to survive, it must undergo a fundamental transformation. Sanny Liao, co-founder and CPO at Fable Security, suggests that the industry should look toward the advertising technology sector for inspiration. "Marketers have gotten remarkably good at changing behavior by delivering the right message at the right time based on context," Liao observes. By moving away from one-size-fits-all, infrequent training toward context-aware behavioral interventions, organizations can start to treat employees as an active part of the defense network rather than the weakest link.
Mike Aalto of Hoxhunt similarly supports a shift toward behavioral training that rewards core actions like threat reporting and the use of multi-factor authentication. By replacing fear-based, heavy-handed surveillance with continuous, gamified learning, organizations can build a cultural bedrock of secure behavior.
Ultimately, the debate is not about whether to discard security awareness training, but how to evolve it. While it can never be a silver bullet that solves the asymmetry of the threat landscape, it remains a necessary component of a holistic defense strategy. As Biswajit De aptly summarizes, expecting security awareness training alone to stop cyberattacks is akin to expecting airport security posters to prevent hijackings. It is one layer of a much larger, more complex architecture—a layer that must be continuously refined, scientifically informed, and integrated into the very fabric of how businesses operate in an age of AI-weaponized deception.
