{"id":1022,"date":"2026-10-09T06:37:18","date_gmt":"2026-10-09T06:37:18","guid":{"rendered":"https:\/\/wyominginvest.com\/?p=1022"},"modified":"2026-10-09T06:37:18","modified_gmt":"2026-10-09T06:37:18","slug":"the-great-security-awareness-dilemma-can-training-survive-the-ai-threat-landscape","status":"publish","type":"post","link":"https:\/\/wyominginvest.com\/?p=1022","title":{"rendered":"The Great Security Awareness Dilemma: Can Training Survive the AI Threat Landscape?"},"content":{"rendered":"

Every modern enterprise conducts security awareness training for its employees. From multi-national corporations to small businesses, organizations routinely mandate hours of instructional videos, phishing simulations, and compliance quizzes. Yet, beneath this ubiquitous corporate ritual lies a growing, contentious debate: whether these programs provide any tangible security benefits at all. <\/p>\n

Empirical evidence paints a bleak picture, suggesting that security awareness training is falling short as successful cyberattacks continue to rise globally. Industry opinions on the true efficacy of awareness training run the gamut, ranging from flat-out assertions that it does not work to claims that it does, with plenty of nuanced perspectives involving words like "sometimes," "perhaps," and "it depends" bridging the two extremes. <\/p>\n

At its core, traditional awareness training focuses heavily on two main tasks: reducing the impact of poor individual judgment that can inadvertently turn an employee into an insider threat, and hardening everyday workers against falling victim to malicious social engineering campaigns. Among these, the vast majority of industry scrutiny centers squarely on the persistent challenge of social engineering.<\/p>\n

Compliance Theater<\/h2>\n

While nearly everyone agrees that awareness training is an important theoretical pillar of corporate defense, the consensus among experts is that it is rarely delivered effectively\u2014and this shortfall is not always the fault of the enterprise itself. Stefan Dasic, a senior malware research engineer at Malwarebytes, points out a fundamental flaw in execution. Most training programs fail simply because of how they are run, often feeling repetitive and generic to employees, which ultimately makes the entire exercise seem pointless.<\/p>\n

Dasic notes that some of that repetition is not just poor design, but is instead driven by rigid compliance and insurance mandates. These regulations frequently require the exact same content to be re-delivered to every single employee every single year, regardless of whether workers already know the material or have seen it multiple times before. The inherent danger in this model is that awareness training is reduced to little more than an annual legal checkbox.<\/p>\n

Robert Costello, chief digital and information officer at Merlin Group, shares similar concerns regarding the current state of enterprise education. Too much of today\u2019s training remains strictly compliance-focused, failing to reflect the highly sophisticated social engineering and artificial intelligence-enabled attacks that organizations face in the modern threat landscape.<\/p>\n

Mike Lyman, a senior security consultant at Black Duck, expands on this industry anxiety. He observes that having to retake identical courses across multiple employers is a concrete illustration of training functioning as mere "compliance theater"\u2014the kind of corporate exercise that produces checkbox completion without driving any actual behavior change. This phenomenon helps explain why some empirical studies find weak or null effects even in organizations where completion rates are impressively high.<\/p>\n

The core problem with rigid compliance requirements, which extends far beyond security awareness training alone, is that they provide a target ceiling to achieve rather than a foundational baseline that can be continuously improved.<\/p>\n

Where and When Training Works<\/h2>\n

Despite the widespread criticism, industry practitioners still see value in educational initiatives under the right conditions. Drew Thompson, global lead for training and enablement at UltraViolet Cyber, believes that awareness training does work, but its effectiveness is largely limited to the specific scenarios explicitly covered by the curriculum. The fundamental problem, however, is that attackers constantly shift their tactics, while traditional training typically tries to prepare people based only on what security teams already know.<\/p>\n

Josh Bartolomie, vice president and global head of threat intelligence at Doppel, echoes this sentiment. He notes that security awareness training still works, but many organizations are incorrectly expecting it to solve a security problem that has fundamentally changed.<\/p>\n

To stay relevant, Thompson suggests that training needs to be delivered much more frequently, must evolve dynamically in lockstep with emerging attack vectors, and should include clear instructions on how to react properly to suspicious messages through behavioral conditioning. Furthermore, training must be tailored much more closely to an employee\u2019s specific role within the business. <\/p>\n

\"Security<\/figure>\n

Thompson emphasizes that training cannot serve as the organization’s sole security control. It must be backed by robust processes, strong identity protections, reliable technical controls, and clear verification procedures. Bartolomie reinforces this view, stating that while awareness remains essential, it can no longer stand as the primary line of defense. Organizations can no longer reasonably expect human employees to act as the final barrier against advanced cyber threats; that critical role belongs to technology.<\/p>\n

Costello agrees that security awareness training still holds a valid role, but insists it should reinforce a modern security architecture rather than attempt to compensate for the total lack of one. <\/p>\n

Biswajit De, co-founder and CTO at CleanStart, adds that awareness should always complement engineering rather than replace it. Good engineering inherently assumes that systems will occasionally fail, and good security design must similarly assume that human beings will occasionally make mistakes.<\/p>\n

Meanwhile, Jim Dolce, CEO at Lookout, argues that while training can be useful, it is fundamentally outmatched within today\u2019s mobile-first, AI-driven threat landscape. The ongoing attempt to forge employees into a "human firewall" through traditional educational modules belongs firmly to an earlier, desktop-centric era of cybersecurity.<\/p>\n

Frontier artificial intelligence has completely transformed the threat landscape, effectively weaponizing social engineering. AI can now generate hyper-personalized, flawless phishing emails and voice clones across mobile communication channels like SMS, WhatsApp, and various messaging apps at machine speed. Security awareness training fails because it asks humans to defeat advanced AI on a six-inch mobile phone screen, attempting to train away what is actually a structural architectural problem.<\/p>\n

Mike Aalto, co-founder and CEO at Hoxhunt, points to a dramatic 14-fold surge in AI-generated phishing attacks observed around the turn of 2025 to 2026. According to Aalto, the major shift is not necessarily the appearance of entirely brand-new tactics or zero-day messaging, but rather the modernization of older, proven attacks. Traditional phishing kits are now being rapidly upgraded with cleaner formatting, superior writing, and highly personalized messaging that can be scaled effortlessly.<\/p>\n

Aalto suggests that the defensive struggle remains fundamentally a game of whack-a-mole. The primary challenge is the massive influx of better-formed, deep-faked communications delivered at greater speed and scope courtesy of large language models, but the underlying dynamic of chasing threats remains unchanged. <\/p>\n

To combat this, Aalto believes that behavioral training must be integrated into standard awareness programs. By focusing on and rewarding a few measurable core behaviors\u2014such as prompt threat reporting and proper multi-factor authentication usage\u2014organizations can establish a cultural bedrock of secure habits. Replacing fear and heavy-handed surveillance with continuous learning and automated behavioral interventions does not just reduce negligence; it transforms the workforce into an active, intelligent human sensor network capable of catching threats that technology alone might miss.<\/p>\n

However, Sanny Liao, co-founder and CPO at Fable Security, offers a more blunt assessment, stating that security awareness training as currently practiced simply does not work for the most part. Social engineering continues to succeed because attackers expertly exploit context, timing, and psychology, while the vast majority of corporate training remains generic, infrequent, and entirely disconnected from the actual moments when employees are making critical decisions.<\/p>\n

Liao points toward a novel industry approach for inspiration, suggesting that cybersecurity leaders look to adtech. Modern marketers have grown remarkably adept at changing human behavior by delivering the right message at the right moment based on contextual relevance. Security awareness programs have historically done the exact opposite by giving every employee the identical training course at the exact same time, completely ignoring individual decision-making contexts or specific risk exposures. When organizations successfully shift toward changing behavior rather than merely raising awareness, employees stop being viewed as the organization’s weakest link and begin acting as an active line of defense.<\/p>\n

Lyman highlights a notable contradiction faced by trainers: data from security firm KnowBe4 has shown that simulated phishing training can produce real, measurable reductions in an organization’s phish-prone rates. Yet, independent academic studies consistently demonstrate that this positive effect fades rapidly. The strong behavioral changes observed immediately following a course often disappear completely within a matter of months.<\/p>\n

\"Security<\/figure>\n

Ultimately, does security awareness training work? As Biswajit De observes, the answer is yes, but expecting training alone to stop sophisticated cyberattacks is much like expecting airport security warning posters to single-handedly prevent hijackings.<\/p>\n

Advantage to the Attacker<\/h2>\n

Social engineers maintain three primary structural advantages over security awareness training: asymmetry, the proactive nature of attacks versus reactive defense, and human psychology.<\/p>\n

The principle of asymmetry dictates that defenders must be right every single time, while attackers only need to be successful once. To combat social engineering effectively, every individual employee must make the correct decision against every attacker, always, and at machine speed. Meanwhile, hundreds of thousands of attackers, heavily assisted by AI tools that maximize performance and scale, need to succeed only a single time. As De notes, attackers do not need everyone to fail; they just need one distracted person on one busy afternoon.<\/p>\n

The second major advantage involves predicting the future. Trainers primarily focus on teaching employees how to recognize yesterday\u2019s attack methods. While excellent training can successfully teach workers to spot today\u2019s known threats, it is difficult to imagine how awareness training can prepare people for the entirely new and evolving attacks that will emerge tomorrow. An organization cannot teach what it does not yet know, meaning that by the time traditional awareness training is officially delivered, its content may already be obsolete.<\/p>\n

The third advantage is human psychology. Human psychology is deeply complex, encompassing intangible variables like memory retention and personal motivation. One must ask whether a full-time accountant can realistically be expected to maintain the same level of vigilance against trickery as a malicious actor whose full-time job is deception, even before considering the natural limitations of human memory.<\/p>\n

While systemic asymmetry is a permanent reality that can typically only be mitigated with a virtually limitless security budget, and predicting the long-term future remains largely impossible, psychology is immediate and current. It represents an area where organizations can actively learn and improve.<\/p>\n

The Psychology of Awareness Training<\/h2>\n

To explore the psychological dimensions of security awareness training, cognitive psychologist Jordan Richard Schoenherr, PhD, a scientist at Humanix and adjunct professor at the University of New South Wales, offers deeper insight. <\/p>\n

Schoenherr shares the perspective that security awareness training is largely failing in its current iterations. This is not to say it cannot work, or at least be significantly improved, but rather that success is exceedingly difficult due to the inherent complexities of the human mind and memory. The primary objective of awareness training is to encode information into long-term memory, pairing it with the correct behavioral response. However, Schoenherr notes that forgetting, or entropy, is the default state of human memory, and it occurs with notable rapidity.<\/p>\n

Frequent learning refreshes are necessary to maintain that memory trace over time. Yet, even when such retention is successful, it does not automatically guarantee that an individual will know precisely when and where to apply that knowledge in the heat of the moment. This is why complementary approaches, such as behavioral nudges, are deployed to reactivate that stored information within a specific operational context.<\/p>\n

Consequently, an employee undergoing training must be equipped to recognize a given situation, retrieve the relevant information from volatile long-term memory, activate it in the present, and correctly recall the appropriate behavioral response\u2014whether that is to accept, ignore, or report the communication.<\/p>\n

Because training must teach students how to identify phishing attempts, it is necessarily limited to known social engineering patterns, which introduces its own set of risks. For example, if training focuses heavily on older scams filled with obvious spelling and grammatical errors, those specific markers become easy to spot. The hidden danger is that the absence of those specific flags in a modern, polished attack might be mistakenly interpreted as proof of validity. In reality, the absence of proof is never proof of absence, a principle that applies universally across all security awareness initiatives.<\/p>\n

\"Security<\/figure>\n

This reality underscores the vital importance of keeping training completely up-to-date with current social engineering practices. The persistent hurdle, however, is that material considered current today may easily become historical trivia by next week. <\/p>\n

Because criminals adapt their attack processes with blistering speed, there is no inherent guarantee that training on yesterday’s methods will adequately prepare people for an attacker’s latest innovations. Training for disruptive innovations fundamentally requires predicting the future\u2014something security trainers and vendors constantly attempt. While short-term prediction is possible, it remains difficult, never guaranteed, and inherently short-lived.<\/p>\n

Schoenherr explains that when individuals are given creative tasks such as forecasting future scenarios, it activates two primary regions of the human brain: the inferior temporal lobe, where long-term memories are stored, and the prefrontal cortex, which handles executive functions. All the building blocks stored in memory are pulled into the prefrontal cortex, which attempts to rearrange, manipulate, and synthesize them into a mental model. The ultimate effectiveness of that mental model relies heavily on analogical reasoning\u2014finding the right shape in long-term memory, or reconstructing a plausible facsimile, to project into the future. This is essentially the exact same cognitive process an employee goes through when trying to determine whether a workplace communication is legitimate or malicious.<\/p>\n

Drawing parallels from financial markets, Schoenherr notes that short-term prediction is achievable for individuals who are intimately aware of existing variables, giving them a mental model congruent with the situation. However, as new variables inevitably emerge, those predictive streaks fade. <\/p>\n

Therefore, can an organization successfully predict the future? Yes, but whether those predictions and subsequent plans prove effective depends entirely on how well the enterprise navigates what is known as decision-making under deep uncertainty. This approach assumes that organizations should develop as many potential scenarios as possible based on known variables, and then run simulations to determine which scenarios produce the optimal outcomes across various iterations. The most resilient scenario is then selected for operational planning.<\/p>\n

While building these scenarios to forecast potential future styles of social engineering is imperfect and will not perfectly predict the state of the world, it remains a necessary exercise. Despite the difficulty\u2014as people naturally tend to fight the last war rather than anticipate the next one\u2014cognitive psychology provides valuable frameworks for navigating the complexities of memory maintenance and retrieval, as well as projecting current knowledge to anticipate likely future threats.<\/p>\n

Summary<\/h2>\n

Understanding cognitive psychology cannot single-handedly solve the structural asymmetry inherent in modern social engineering threats. That specific challenge can only be truly mitigated or reduced through substantial financial investment, whereas most corporate security budgets are kept at the absolute minimum. <\/p>\n

However, psychological insights can greatly assist organizations in predicting the future direction of social engineering tactics. More importantly, they can directly guide the design of security awareness training methodologies that are far more likely to yield tangible results.<\/p>\n

By combining the lessons learned from current training practices\u2014such as combining awareness education and behavioral conditioning with regular reinforcement frequency and supporting technology\u2014with proven human cognitive processes, the industry can develop significantly improved training frameworks. While these programs will never achieve absolute perfection, security awareness training cannot simply be abandoned. Instead, it must continue to evolve.<\/p>\n","protected":false},"excerpt":{"rendered":"

Every modern enterprise conducts security awareness training for its employees. From multi-national corporations to small businesses, organizations routinely mandate hours of instructional videos, phishing simulations, and compliance quizzes. Yet, beneath this ubiquitous corporate ritual lies a growing, contentious debate: whether these programs provide any tangible security benefits at all. Empirical evidence paints a bleak picture,<\/p>\n","protected":false},"author":2,"featured_media":1021,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[1089,323,1171,321,1170,320,1173,5,1172,77,322,1090],"class_list":["post-1022","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-awareness","tag-blockchain-analysis","tag-dilemma","tag-forensics","tag-great","tag-incident-response","tag-landscape","tag-security","tag-survive","tag-threat","tag-tracking","tag-training"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1022"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/1022\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/1021"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}