Why most security training fails and how behavioral science can fix it

We need to face a bitter truth: Most security awareness training out there just doesn’t work the way it’s supposed to. Year after year, companies worldwide pour billions into all sorts of training programs, posters, and click-through modules, yet phishing click incident rates stubbornly persist with no sign of them fading away any time soon. So, what are we missing?

According to Verizon’s Data Breach Investigations Report, the human element is involved in 62% of breaches. This number barely budges, no matter how much money companies spend on teaching their staff the basic idea of not clicking suspicious links. It almost feels like we’re running on a hamster wheel—so much training, so little benefit.

Where traditional training falls short

The problems with most traditional mandatory training initiatives boil down to these three main points:

1. The compliance check box mindset 

Most training programs are designed in the form of a task that needs to be ticked off a worker’s to-do list, not as a genuine process to truly change the way they think about this highly critical topic. Furthermore, many employees may view it as a burden that interferes with their already busy schedules. The annual mandatory security awareness modules are a case in point as many employees blaze through them just to click the I confirm completion of the course check box at the end.

2. The Ebbinghaus forgetting curve

The Ebbinghaus forgetting curve is the classic psychological principle that information fades fast unless it's reinforced regularly, in small doses. Within days, most people forget what they’ve learned, so those yearly sessions barely register. That’s why most employees who dash through these cybersecurity materials are likely to forget most of it in a matter of days, especially when they are swamped with all sorts of other critical information, data, and tasks immediately related to their day-to-day work.

3. Scare tactics only work if employees know how to win 

A lot of corporate training utilizes cyber horror stories to grab employees’ attention. However, advanced research into fear appeals in information security reveals that fear alone isn't enough. 

If you scare someone without giving them high-efficacy tools that make them feel 100% confident that they can spot and report a phishing link, they mentally tend to shut down. Instead of fighting the threat, they practice fear control, meaning they tune out the training entirely to avoid feeling anxious.

Why we click anyway: The psychology behind mistakes

If we want employees to stop falling for phishing emails, we first need to understand why they click in the first place. The reasons aren't laziness or stupidity. They're due to how our brains are wired to make quick decisions. Once organizations understand these root causes, they can design training that actually addresses them, instead of just repeating "Be careful."

Cognitive shortcuts (heuristics)

Let's be honest: Most employees are busy, tired, and drowning in emails. So instead of carefully analyzing every message, the brain takes shortcuts, skimming for familiar patterns rather than scrutinizing details. In his book, Thinking, Fast and Slow, Daniel Kahneman calls this System 1 thinking (fast and intuitive) versus System 2 thinking (slow and effortful).

Phishing emails are designed to exploit exactly this. They're made to look normal enough to slide past System 1 without triggering System 2.

Authority bias and urgency

That's also a big part of why phishers thrive on impersonating bosses or manufacturing urgency, as humans are conditioned to respond promptly to both. Robert Cialdini's seven principles of persuasion, especially authority and scarcity, explain why CEO fraud emails work so well: Even sharp, experienced employees can get caught off guard when a message feels urgent and comes from someone they're supposed to obey. To explain this further, let us go through the authority and scarcity principles in some detail:

Authority

The authority factor is rather straightforward. As humans, we are generally hardwired to comply with the commands of our superiors. Scammers know this little trick and are keen on using it against us. 

Scarcity

Scarcity isn't exclusively related to material things like a limited time offer on your favorite brand of tennis shoes or the latest iPhone. It can also extend to include immaterial things, such as time itself.

For example, when a scammer designs their email along the lines of "I am heading into an executive meeting in 20 minutes. I need this ready ASAP!," they are essentially playing on the scarcity factor. The employee here will not have much time to think it through. They fear that if they fail to comply promptly, this would make their boss look bad in front of their board of directors, or the company might miss out on a big business opportunity, for instance.

This scenario (a seemingly urgent request from above) demonstrates how spear phishing scams play out in the real world. For a few tips on how to spot these tricks in action, take a look at our breakdown of how to spot a scammer pretending to be your boss.

What actually works: Behavioral science to the rescue

It's a known fact that to prevent any form of cybercrime (or any other crime, for that matter), it is essential to think like the criminal: to put yourself in the criminal's shoes and traverse all the possible vulnerabilities and holes they might exploit to attack you. Phishing attacks are no exception and can be devastating if not thoroughly understood and guarded against.

Behavioral science provides numerous highly effective methods to train the human mind to recognize and respond to potential phishing risks properly and safely:

Simulated phishing and real-time feedback

Instead of from an annual training video, employees learn best from realistic phishing simulations paired with instant, specific feedback the moment they click (or correctly report) a test email. This turns training into practice rather than theory; the brain retains lessons tied to an experience far better than ones delivered in the abstract. SANS' Security Awareness Report backs this up, finding that short, frequent micro-training sessions beat long, infrequent ones, which lines up with what we know about the Ebbinghaus forgetting curve.

Gamification and habit-building 

Security awareness is best retained when it's built as a habit, not assigned as a task. Small, repeatable actions, like clicking Report phishing, become second nature when there's a reason to keep doing them. If we follow the gamification method, this reason can take the form of streaks, badges, team leaderboards, or friendly competitions between departments.

The goal isn't to gamify security for its own sake but to make proper, secure behavior a normal part of the everyday mindset. This is similar to how habit formation apps turn flossing or exercise into something people do naturally and routinely.

Positive reinforcement over punishment

Finally, how organizations respond to mistakes is just as critical as how they train employees to avoid them. Shaming someone for clicking a phishing link—or failing a fake internal test—doesn't make people more careful. It just teaches them to hide their errors and sweep them under the rug instead. It fosters a culture of fear and secrecy rather than one of openness and learning.

Richard Thaler and Cass Sunstein make this case in their 2008 book Nudge: Subtle, positive nudges that reward the right behavior produce lasting, preferable change. Punishment, on the other hand, tends to breed resentment, pushing employees to stay silent about mistakes rather than come forward.

In practice, this translates to flipping the script: celebrating the employee who reports a suspicious email, even if it turns out to be a false alarm, instead of only reacting when they get it wrong.

Closing thoughts: Culture eats compliance for breakfast

All of this points to a bigger truth that technical controls only go so far if the culture around them punishes honesty. The best security cultures borrow a page from aviation and healthcare: two industries that learned this lesson the hard way. Both operate on what's known as a just culture: one that encourages people to report mistakes and near misses without fear of blame. Research from these fields shows that as long as employees feel safe to speak up, organizations are more likely to catch problems earlier and learn faster than they ever could under a punitive blame game. There's no reason cybersecurity should be any different.

It's time to admit that cybersecurity isn't just a technology problem: It's a human behavior problem. Training can't be a once-a-year check box exercise handed off to the compliance team. It has to be treated as an ongoing behavioral design challenge, built on real evidence from psychology and behavioral science, and reinforced at every level of the organization, not just for end users.

So, in a nutshell: You want real, lasting security? Always start with the human mind.