Why Security Awareness Training Needs a Rethink Against Modern Social Engineering
Summary
Experts say generic, infrequent awareness training struggles against evolving, AI-assisted social engineering. The article explores memory and behavior, recommending refreshed, contextual training backed by technical controls and clear processes.
Key points
- Compliance-driven, repetitive courses may produce completion without lasting behavior change; training effects can fade within months.
- AI-assisted phishing can be more polished, personalized, and delivered at scale, while training often addresses known attack patterns.
- Experts recommend frequent, role-specific training that teaches employees how to respond to suspicious messages, not just recognize them.
- Behavioral reinforcement, such as encouraging threat reporting and MFA use, may help apply learning in real situations.
- Training should complement identity protections, technical controls, clear verification processes, and security engineering rather than serve as the sole defense.
- A cognitive psychologist explains that memory fades and that contextual prompts may help people retrieve relevant learning when making decisions.
Article Details
- Topic
- The effectiveness and redesign of security awareness training against social engineering, including how cognitive psychology, behavioral conditioning, and evolving AI-enabled attacks shape training methods.
People
Biswajit DeCo-founder and CTO at CleanStart; discusses the role and limits of awareness training.Drew ThompsonGlobal lead for training and enablement at UltraViolet Cyber; discusses how training can be improved.Jim DolceCEO at Lookout; comments on training amid mobile AI threats.Jordan Richard SchoenherrCognitive psychologist at Humanix and adjunct professor at the University of New South Wales; discusses memory, cognition, and security awareness training.Josh BartolomieVP and global head of threat intelligence at Doppel; comments on the changing problem security awareness training addresses.Mika AaltoCo-founder and CEO at Hoxhunt; discusses AI-generated phishing and behavioral training.Mike LymanSenior security consultant at Black Duck; discusses compliance theater and evidence on simulated phishing training.Robert CostelloChief digital and information officer at Merlin Group; comments on compliance-focused training.Sanny LiaoCo-founder and CPO at Fable Security; comments on context-aware approaches to changing security behavior.Stefan DasicSenior malware research engineer at Malwarebytes; comments on why training programs fail.
Vendors
Black DuckMike Lyman, senior security consultant at Black Duck, expands on this concern.CleanStartBiswajit De, co-founder and CTO at CleanStart, adds, “Awareness should complement engineering, not replace it.DoppelJosh Bartolomie, VP, global head of threat intelligence at Doppel, agrees.Fable SecurityHowever, Sanny Liao, co-founder and CPO at Fable Security, says bluntly, “For the most part, security awareness training as done today does not work.HoxhuntMika Aalto, co-founder and CEO at Hoxhunt, points to a 14-fold surge in AI-generated phishing at the turn of 2025 to 2026.HumanixTo explore this angle of security awareness training, we talked to cognitive psychologist Jordan Richard Schoenherr, PhD, a scientist at Humanix and adjunct professor at the University of New South Wales.KnowBe4KnowBe4 data has shown that training with simulated phishing can produce real reductions in phish-prone rates.LookoutJim Dolce, CEO at Lookout, believes training can be useful, “but is fundamentally outmatched within today’s mobile AI threat landscape.MalwarebytesStefan Dasic, senior malware research engineer at Malwarebytes, suggests, “Most training programs fail because of how they’re run.” He believes they are repetitive and generic, making them seem pointless.UltraViolet CyberDrew Thompson, global lead for training and enablement at UltraViolet Cyber, believes awareness training works, but primarily for the specific situations covered by the training.