1 min Reading Time<\/p>\n
Security Awareness Training is a billion-dollar market – and yet, phishing click rates remain consistently high. According to Proofpoint, 10-15% of employees click on links in well-crafted phishing simulations. Annual mandatory training that is forgotten after three months has not changed this. What actually helps is more complex and interesting.<\/strong><\/p>\n Behavioral psychology is clear: knowledge alone does not change behavior. Ebbinghaus’ forgetting curve shows that 70% of what is learned is forgotten after 24 hours, and 90% after a week. A 2-hour training session in January has little impact on behavior during a phishing attack in October.<\/p>\n Additionally: Traditional training lacks context. “Don’t click on links in emails” sounds simple, but in the workday, almost all links are legitimate. Employees cannot assess risks in the moment of stress, such as when they are in meetings and need to quickly respond to an email.<\/p>\n Just-in-time training:<\/strong> When an employee clicks on a link in a phishing simulation, a short (2-3 minute) learning unit immediately appears, explaining what gave away that it was phishing. The context is fresh, and the emotion (slight embarrassment) reinforces learning. Providers: KnowBe4, Proofpoint Security Awareness, Hoxhunt.<\/p>\n Nudging and friction:<\/strong> Technical measures that help with correct behavior: banners in emails from external senders, warning dialog for attachments from unknown senders, auto-forward block for external addresses. This structurally reduces the likelihood of errors.<\/p>\n Positive reinforcement:<\/strong> Companies that actively reward employees for reporting suspicious emails (gamification, public recognition, small bonuses) see significantly higher reporting rates. Higher reporting rates mean faster incident detection.<\/p>\n Most awareness programs measure “completed training” – this is not a security KPI, it’s a compliance KPI. Effective programs measure:<\/p>\n Phishing click rate:<\/strong> Trend over time is more important than the absolute value. Goal: continuous reduction, not 0% (unrealistic).<\/p>\n Reporting rate:<\/strong> What percentage of employees report suspicious emails? An increasing reporting rate is a better security indicator than a decreasing click rate alone.<\/p>\n Time-to-report:<\/strong> How quickly are incidents reported? Shorter time means faster incident response.<\/p>\n Repeat offenders:<\/strong> Who clicks repeatedly? Targeted additional measures for this group are more efficient than further mass training.<\/p>\n Phishing click rate without training:<\/strong> ~25-30% in simulations (Proofpoint 2025)<\/p>\n Phishing click rate after just-in-time training:<\/strong> Reduction to 5-10% possible<\/p>\n Forgotten after 1 week:<\/strong> ~90% of what is learned in training (Ebbinghaus curve)<\/p>\n Security Awareness market size:<\/strong> Over 5 billion USD worldwide (2025)<\/p>\n Most frequent target:<\/strong> HR, Finance, and new employees (< 6 months) disproportionately affected<\/p>\n Fact:<\/strong> According to the IBM Cost of a Data Breach Report 2025, 95% of security breaches are caused or enabled by human error.<\/p>\n Fact:<\/strong> Companies with regular Security Awareness programs reduce phishing email click rates by an average of 75% within 12 months, per the SANS Institute.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Monthly is the recommended cadence for active simulations. More important than frequency is variety: different campaign types, sender scenarios, and audience segments. Predictable simulations get recognized and lose their learning impact.<\/p>\n<\/details>\n In Germany: Yes, with caveats. The works council must be informed and involved (co-determination obligation under \u00a787 BetrVG). A works agreement on Security Awareness is strongly advised. Individual results must not be used for HR decisions.<\/p>\n<\/details>\n KnowBe4 leads the market (largest content library, strong gamification). Proofpoint Security Awareness Training excels in email integration. Hoxhunt focuses on gamified, behavior-based learning. Mimecast offers robust integration with email gateways.<\/p>\n<\/details>\n Leadership must model the behavior: CISOs and C-level executives actively participate in training and communicate security as a core value. Reporting incidents is rewarded – not punished. Mistakes are treated as learning opportunities. Security is embedded into onboarding, performance reviews, and internal communications.<\/p>\n<\/details>\n Direct measurement is challenging – but possible: fewer successful phishing attacks (tracked via incident counts), shorter time-to-report, fewer helpdesk tickets related to accidentally opened attachments, and insurance cost comparisons before and after program rollout.<\/p>\n<\/details>\n \u2192 Phishing Simulations in Practice<\/p>\n \u2192 Social Engineering 2024: AI Makes Attacks More Dangerous<\/p>\n HR and Corporate Culture: mybusinessfuture.com<\/a><\/p>\n Security for C-Level Executives: digital-chiefs.de<\/a><\/p>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
\n
Why Traditional Training Doesn’t Work<\/h2>\n
What Works: Behavior-Based Approaches<\/h2>\n
KPIs for an Effective Awareness Program<\/h2>\n
Key Facts at a Glance<\/h2>\n
Frequently Asked Questions<\/h2>\n
How often should phishing simulations be conducted?<\/strong><\/summary>\n
Is it legal to subject employees to simulated phishing tests without prior notice?<\/strong><\/summary>\n
What are the best tools for Security Awareness?<\/strong><\/summary>\n
How do you build a security culture?<\/strong><\/summary>\n
How do you measure the ROI of Security Awareness?<\/strong><\/summary>\n
More Articles on This Topic<\/h2>\n
Further Reading Across the Network<\/h2>\n
Related Articles<\/h2>\n
\n