{"id":112554,"date":"2026-09-28T12:00:00","date_gmt":"2026-09-28T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=112554"},"modified":"2026-09-16T11:29:57","modified_gmt":"2026-09-16T11:29:57","slug":"cybersecurity-training-doesnt-work-heres-why","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/career\/cybersecurity-training-doesnt-work-heres-why\/","title":{"rendered":"Cybersecurity training doesn’t work – here’s why"},"content":{"rendered":"\n
\n

Cybersecurity training doesn’t reduce phishing risk. Studies show most staff already know the answers before they take the course, don’t engage with the material, and behave no differently afterward. <\/strong><\/p>\n\n\n\n

Why, then, do companies keep running cybersecurity (and compliance) training anyway? Greg Low has thoughts<\/strong>.<\/p>\n\n\n\n

Not too long ago, I read about a study<\/a> that concluded that cybersecurity training doesn\u2019t actually work<\/em><\/strong>. I can\u2019t say I was surprised by it – and here’s why.<\/p>\n<\/blockquote>\n\n\n\n

Why compliance training exists (and it’s not to teach you)<\/h2>\n\n\n\n

I spend a lot of time mentoring on client sites – many of which are large organizations – and they often require me to attend regular ‘training’ sessions to satisfy their corporate compliance<\/a> goals.<\/p>\n\n\n\n

I don\u2019t at all mind taking these courses, despite their repetition. At company A, I complete one on conflicts of interest, or handling private or sensitive data<\/a>, or IT security<\/a>, and over at company B I take another that’s nearly word-for-word identical. It then happens again at company C.<\/p>\n\n\n\n

This, also, is not surprising. After all, there aren’t many vendors producing this ‘training’ content for business use, so content overlap is inevitable.<\/p>\n\n\n\n

Is the password advice even accurate?<\/h2>\n\n\n\n

I’m always fascinated by the information presented as factual<\/em> in these courses. For a simple example: password complexity and rotation.<\/p>\n\n\n\n

Many large companies I consult with have rules that say user passwords must<\/em> contain a certain combination of upper and lower-case characters, numbers, etc – and these passwords should be changed regularly. This is considered ‘perceived wisdom’. <\/p>\n\n\n\n

By default, Windows want to enforce the same rules – and corporate cybersecurity<\/a><\/strong> regards both as something that users need<\/em> to know. <\/p>\n\n\n\n

If I ever ask the organization why<\/em> they do this, the answer is simple: security.<\/strong><\/p>\n\n\n\n

NIST vs ‘perceived wisdom’<\/h3>\n\n\n\n

The National Institute of Standards and Technology (NIST)<\/a> doesn’t just repeat this information. They researched these topics. Their guidelines<\/a> completely disagree<\/em> with the ‘perceived wisdom’ I mentioned above.<\/p>\n\n\n\n

SP 800-63B Section 5.1.1.2 paragraph 9<\/a> says: “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily<\/strong> (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”<\/em><\/p>\n\n\n\n

The same paragraph recommends against the use of composition rules.<\/p>\n\n\n\n

The bottom line is: the research shows that this requirement has the overall effect of reducing security – not increasing it. <\/strong><\/p>\n\n\n\n

But let’s not allow research get in the way of ‘perceived wisdom’…<\/p>\n\n\n\n

Completion isn’t learning: how these courses are measured<\/h2>\n\n\n\n

Let’s start by agreeing that training should involve learning<\/em> something. There should be a way to measure something as ‘different’ after the training has been completed. At the organizations I consult at, however, the vast majority of staff wouldn\u2019t actually learn anything from these courses. <\/p>\n\n\n\n

Invariably, the questions they need to get correct – say, 80% correct – are so mind-numbingly obvious that I see many of them not even paying attention when the videos are playing. Then, at the end, they quickly answer the questions just to keep their managers happy. <\/p>\n\n\n\n

So many of these quizzes are absurd.<\/p>\n\n\n\n

Why do these courses even exist then?<\/h3>\n\n\n\n

The primary reasons these courses exist are twofold. <\/p>\n\n\n\n

Firstly, to provide backside protection for the companies (rather than being about actually teaching the staff something<\/em>).<\/p>\n\n\n\n

Second, to facilitate an easy way to blame staff when something goes wrong. After all, once they’ve ‘taken’ the course, the staff can’t say they ‘didn’t know’.<\/em><\/p>\n\n\n\n

What the company is actually measuring is completion, not learning. <\/strong><\/p>\n\n\n\n

And, if nearly everyone could pass the assessment before<\/em> taking the course, the assessment cannot demonstrate that the course has actually taught anyone anything new.<\/p>\n\n\n\n

Does training actually stop phishing?<\/h2>\n\n\n\n

All the evidence – including the outcome of the report I referenced earlier – says no<\/em>. This training does not actually stop or reduce the risk of phishing<\/a>.<\/strong><\/p>\n\n\n\n

The general way this is tested afterwards is by sending (fake) malicious emails that pretend to be legitimate, to see what employees will click on, or what information they provide – if any. <\/p>\n\n\n\n

And the outcome of the report shows little evidence of any change in behavior after<\/em> the training.<\/p>\n\n\n\n

Ironically, the report concluded that “one reason the trainings are not effective is that the majority of people do not engage with the embedded training materials.”<\/em><\/p>\n\n\n\n

That’s exactly the point I was making earlier.<\/p>\n\n\n\n

OK, it’s ineffective – but why is that a problem?<\/h3>\n\n\n\n

My biggest issue is that, for many companies, nearly their entire corporate training budget is being spent on these courses. <\/p>\n\n\n\n

My take: the cost of delivering this material should be in a ‘corporate compliance’ budget, not in anything that pretends<\/em> to be the ‘training’ budget.<\/strong><\/p>\n\n\n\n

Staff often don’t have any budget available to them to learn something that could actually help with their job.<\/p>\n\n\n\n

What would actually reduce phishing risk<\/h2>\n\n\n\n

Most of the people being ‘trained’ at these companies aren’t even IT staff – they often just have IT access as an ancillary part of their role. So, what the training tries<\/em> to do is teach them routine ways to identify phishing attacks.<\/p>\n\n\n\n

That might sound like a great idea, but is it really? If you can train a non-IT person to take a series of steps to avoid a phishing scam, the real question is: why haven’t your IT systems taken the same steps?<\/em> <\/p>\n\n\n\n

Why did the malicious content even reach the staff member in the first place?<\/p>\n\n\n\n

We IT people need to do better.<\/p>\n\n\n\n

Summary<\/h2>\n\n\n\n

The real problem isn\u2019t that organizations care about security or compliance. Instead, it\u2019s <\/strong>that they often confuse proving<\/em> that training occurred <\/em>with actually changing behavior<\/em>.<\/strong> <\/p>\n\n\n\n

If staff already know the answers, don\u2019t engage with the material, and behave no differently afterwards, then calling it ‘training’ is – at best – generous. Worse, it can consume the budget that could instead be used on helping people genuinely <\/em>improve their skills. <\/p>\n\n\n\n

Compliance requirements may still need to be satisfied, but we should call them what they are. <\/p>\n\n\n\n

And, when it comes to threats like phishing, the better answer isn\u2019t simply to keep telling users to be more careful – it\u2019s to build IT systems that don\u2019t rely on every employee successfully identifying every attack.<\/strong><\/p>\n\n\n\n

\n
\n
\n
\n

Protect your data. Demonstrate compliance.<\/h3>\n
\n With Redgate, stay ahead of threats with real-time monitoring and alerts, protect sensitive data with automated discovery & masking, and demonstrate compliance with traceability across every environment. <\/div>\n <\/div>\n Learn more<\/a>\n <\/div>\n <\/div>\n<\/section>\n\n\n
\n

FAQs<\/h2>\n\n

1. Does cybersecurity training reduce phishing risk?<\/h3>\n
\n

Evidence suggests no. Research into corporate security training found little change in employee behavior after completion, largely because most people don’t engage with the training material in the first place. Training measures completion, not learning.<\/p>\n <\/div>\n

2. Why do companies keep running cybersecurity training that doesn't work?<\/h3>\n
\n

Two reasons: it protects the organization legally, and it lets staff be blamed when something goes wrong, since they can no longer say they ‘didn’t know.’ Neither reason is about actually teaching people something new.<\/p>\n <\/div>\n

3. What's a more effective way to prevent phishing attacks?<\/h3>\n
\n

Building IT systems that don’t rely on every employee spotting every attack. If a non-technical staff member can be trained to catch a phishing email, the same steps could usually be automated in the mail or security system before it ever reaches them.<\/p>\n <\/div>\n <\/section>\n","protected":false},"excerpt":{"rendered":"

Research shows cybersecurity training rarely changes behavior or stops phishing. Here’s why compliance courses fail – and what actually reduces risk instead.…<\/p>\n","protected":false},"author":346483,"featured_media":113084,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[45105,53,46],"tags":[4362,4619,5765,4341],"coauthors":[159368],"class_list":["post-112554","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-career","category-featured","category-data-security-privacy-compliance","tag-career","tag-security","tag-security-and-compliance","tag-training"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/users\/346483"}],"replies":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/comments?post=112554"}],"version-history":[{"count":16,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112554\/revisions"}],"predecessor-version":[{"id":113097,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/112554\/revisions\/113097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media\/113084"}],"wp:attachment":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media?parent=112554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/categories?post=112554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/tags?post=112554"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/coauthors?post=112554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}