SecurityWeek concludes that security awareness training remains useful, but fails when it becomes a generic annual compliance course disconnected from the employee’s context or the moment of decision-making. As AI-powered phishing and social engineering evolve, recurring behavioral training should be integrated with technical and identity controls, as well as reporting and verification procedures.
The value of security awareness training is not disappearing, but the traditional way of delivering it is no longer sufficient in the face of rapidly changing social engineering attacks that benefit from artificial intelligence. This is the central conclusion of an analysis published by SecurityWeek, after hearing the views of security experts and a cognitive psychologist.
Training typically focuses on reducing employee mistakes that could turn them into an insider threat, and on helping them resist phishing messages and manipulation techniques. However, the continued success of attacks, despite the widespread adoption of training programs, raises the question of whether these programs actually change behavior or merely demonstrate completion of a required course.
From Training to Merely Meeting Requirements
Stefan Dasic of Malwarebytes believes that many programs fail because of the way they are operated; they are repetitive and so generic that they appear pointless. Other experts add that compliance and insurance requirements push organizations to reuse the same content for all employees every year, regardless of their prior knowledge or the nature of the risks they face.
This practice may produce high completion rates without a comparable change in behavior. Focusing on compliance can also turn the required minimum into the final objective, rather than treating it as a baseline that can be improved. According to the views presented in the analysis, generic courses do not always reflect modern social engineering methods or attacks that use artificial intelligence.
What Changes in Practice?
Training works when it prepares an employee for a specific situation, but attackers are constantly changing their methods. Experts therefore propose that training be more frequent, more closely related to the employee’s role, and include clear guidance on what to do when a message or request appears suspicious or unusual, such as reporting or verifying it rather than merely identifying signs of phishing.
Participants stress that training cannot be the only line of defense. It must be supported by a modern security architecture that includes identity protection, multi-factor authentication, technical controls, and clear verification procedures. Good system design assumes the possibility of human error rather than placing responsibility on employees to stop every attack.
The task is becoming more difficult with attacks that produce more convincing and personalized messages, alongside voice cloning and the use of mobile channels such as text messages, WhatsApp, and messaging applications. The analysis quotes Mike Aalto of Hoxhunt as estimating a 14-fold increase in AI-generated phishing when moving from 2025 to 2026, along with the improvement of old methods rather than the emergence of entirely new tactics.
Behavior and Context Matter More Than Memorization
The article indicates that phishing simulations can temporarily reduce failure rates, but this effect may fade within months. Some experts therefore recommend continuous behavioral training focused on a limited number of measurable actions, such as reporting threats and using multi-factor authentication, while providing interventions and reminders in the appropriate context.
One perspective compares security awareness with digital advertising: instead of sending the same message to everyone at the same time, awareness efforts can be designed to reach employees when they face a particular decision or risk. The goal is not to regard the employee as the weakest link, but to make them an active part of the monitoring and response system.
Limits of Memory and Prediction
Jordan Richard Schoenherr, a cognitive psychologist at Humanix and an assistant professor at the University of New South Wales, explains the difficulty of training by noting that forgetting is the default state of memory, and happens quickly. Even remembering information does not guarantee knowing when and how to use it. Learning therefore requires frequent updating and behavioral cues that reactivate knowledge at the moment of decision-making.
But teaching employees to recognize known patterns carries an additional risk: they may interpret the absence of spelling mistakes or traditional warning signs as evidence that a message is legitimate, when it is not. Training can also become outdated as new variables emerge, making it more useful to build multiple scenarios and make decisions amid deep uncertainty than to rely on a single prediction about the future.
The editorial view from certi.news: Real change does not mean eliminating training, but moving it from an annual compliance program to an ongoing operational capability that measures behavior and supports it with technology. However, the article does not establish that any single model has solved the problem; experts acknowledge that training will remain limited in the face of asymmetric risks, the speed of attacks, and the complexity of human memory. Open questions therefore remain tied to how to measure behavioral change, how long it lasts, and how capable organizations are of updating training faster than attackers adapt.