Why Security Awareness Training Fails
- PYXIS
- Apr 14
- 5 min read
Security awareness training often fails for a simple reason: it asks people to behave differently in a system that still rewards the old behaviour.
That is why so many organisations complete the training, track the completion rates, and still see password sharing, delayed reporting, unsafe workarounds, and avoidable cyber risk.
The message may be understood, but the working conditions have not changed. If leaders want training to reduce risk, they need to look beyond awareness and examine the environment in which decisions are actually being made.
Where the problem really sits
Training rarely fails because people did not hear the message. It fails because the wider system keeps pulling them in another direction.
Most employees already understand the basics. They know they should use secure passwords, avoid suspicious links, report phishing quickly, and follow access rules. Yet risky behaviour persists.
That should tell leaders something important:
The gap is not always knowledge. It is often friction, speed pressure, poor usability, conflicting incentives, and unclear consequences.
In other words, people are being asked to follow secure behaviours in a system that often makes those behaviours slower, harder, or less practical than the alternative.
This is why cyber security culture cannot be reduced to awareness alone. The real issue is whether people, policies and technology are aligned well enough for secure behaviour to be workable in practice.
What awareness programmes often miss
A training course can explain the rule without changing the conditions that drive risky decisions.
Many awareness programmes are designed around information transfer. They tell people what good looks like, describe common threats, and remind staff of their responsibilities. That can be useful, but it is only one part of the problem.
If a person is under pressure to move quickly, locked out by an awkward control, unsure how to escalate a concern, or used to seeing secure behaviour slow work down, training will not override that reality for long. It may create temporary attention, but not lasting control.
That is why organisations often mistake awareness for capability. Knowing the right answer is not the same as being able, willing, and supported to act on it consistently when work becomes inconvenient.
The patterns behind repeated failure
When training does not translate into behaviour, the drivers usually sit elsewhere in the system.
The most useful question is not whether staff completed the module. It is what made the insecure action easier than the secure one.
Common drivers include:
Security Controls That Create Too Much Friction
Incentives That Reward Speed Over Secure Process
Weak Or Delayed Feedback After Reporting Phishing Or Suspicious Activity
Exception Handling That Quietly Normalises Unsafe Behaviour
Poorly Designed Processes That Encourage Shadow Tools Or Workarounds
Managers Who Prioritise Delivery Without Reinforcing Security Expectations
Training That Is Generic Rather Than Tied To Real Risk Decisions
These conditions matter because people adapt to the system they work in.
If the system makes security feel like an obstacle, behaviour will eventually reflect that, regardless of how often the training is repeated.
The question leaders should ask instead
The real test is whether secure behaviour is easier to sustain than insecure behaviour under pressure.
A better question for leaders is this: when someone is rushed, overloaded, or trying to keep work moving, what does the system make most likely?
If secure behaviour is slower, less supported, or harder to complete than the insecure alternative, the organisation has already created the conditions for training failure. The staff member may still know the rule, but the operating environment is pointing them in a different direction.
That is why the answer is rarely “more training” on its own.
A stronger response starts by identifying where secure behaviour breaks down in the flow of work, then fixing the conditions that make the wrong choice easier.
What a stronger response looks like
Training works best when it is reinforced by usable controls, clear leadership, and practical system design.
Organisations that get more value from security awareness do not rely on training as the main control. They treat it as one part of a wider operating system.
Practical improvements often include:
Redesign Controls That Staff Routinely Bypass
Reduce Friction In Everyday Secure Behaviours
Align Manager Signals With Security Expectations
Improve Phishing Reporting Speed And Feedback
Tighten Exception Governance So Temporary Workarounds Do Not Become Normal
Tailor Training To Real Scenarios And Decision Points
Make Clear Who Owns Security Decisions When Trade-Offs Arise
This is where PYXIS adds a different lens. The issue is not whether people have been told enough. It is whether the organisation has made secure behaviour realistic, timely, and sustainable.
What better measurement looks like
Completion rates are easy to report, but they say little about whether risk is actually falling.
Many organisations still treat training completion as the primary sign of progress. It is visible, simple, and easy to show upward. It is also weak on its own.
More useful leading indicators and KPIs may include:
Phishing Reporting Speed
Percentage Of Suspected Emails Reported
Security Exception Volume And Repeat Themes
Frequency Of Workarounds Around Key Controls
Time Taken To Resolve Access Or Security Friction
User Confidence In Reporting Suspicious Activity
Repeat Issues In Teams With Full Training Completion
Adoption Of Secure Behaviours In High-Risk Workflows
These measures reveal whether awareness is turning into safer behaviour, not just whether people clicked through a module.
The leadership implication
If awareness is rising but insecure behaviour persists, the problem is unlikely to be awareness alone.
Boards and leaders should be wary of treating training as evidence of control. A well-run awareness programme can support stronger behaviour, but it cannot compensate for weak design, conflicting incentives, or controls that do not work in practice.
Security awareness training fails when leaders use it as a substitute for fixing the system around the user. It succeeds when it sits inside a culture where secure behaviour is reinforced by the way work is organised.
That is the real test. Not whether staff know the rule, but whether the organisation has made the right behaviour easier to choose.
Key topics covered in this article
Security Awareness Training Often Fails For Systemic Reasons
Knowledge Alone Does Not Change Behaviour
Friction And Speed Pressure Can Undermine Secure Choices
Completion Rates Are A Weak Measure Of Real Control
Insecure Behaviour Often Reflects Poor System Design
Better Results Depend On People, Policies And Technology Working Together
Stronger Security Culture Requires Usable Controls And Clear Signals
Leading Indicators Show Whether Training Is Changing Real Behaviour
About PYXIS Culture Technologies
PYXIS Culture Technologies helps organisations understand and improve the drivers of performance, safety, and cyber resilience.
By combining deep research, operational experience, and advanced culture analytics, we help organisations close the gap between strategy and everyday behaviour.
Our approach is effective:
We treat culture as a systemic business issue, not an HR initiative.
We identify key internal business practices that create performance and risk challenges and provide effective solutions you can immediately implement.
We link organisational culture to business and financial metrics, showing a clear ROI for strengthening alignment and performance.
Connecting the dots
See how PYXIS helps organisations identify the conditions that weaken secure behaviour, encourage workarounds, and leave training carrying too much of the load.