1 min Reading Time<\/p>\n
Companies spend billions on security awareness training. Yet, phishing click rates do not sustainably decrease. The problem isn’t a lack of training but the model: Annual mandatory videos don’t change behavior. What works are continuous, context-based micro-interventions and technical safeguards that catch human errors.<\/strong><\/p>\n Most security awareness programs exist to meet compliance requirements – not to change behavior. Watch a 30-minute video once a year, pass a quiz, check a box. Studies show: The effect wears off after 4-6 weeks. Knowledge retention is minimal, and behavioral change is even less.<\/p>\n USENIX research (2023) shows: The difference in phishing click rates between companies with and without awareness training is less than one percentage point. The investment does not match the results.<\/p>\n Behavioral science shows: People change their behavior not through knowledge but through context-based interventions at the moment of decision. A warning “This email is from a new sender” directly in the email client is more effective than any training video.<\/p>\n Microsoft implemented this approach with Safety Tips and External Sender Tags. Google displays warning banners for suspicious links. These in-context nudges reduce the click rate on phishing links by 40-50 percent – many times the effect of training.<\/p>\n Phishing simulations are the most popular tool – and the most controversial. Pro: They measure the actual click rate and identify high-risk users. Con: They create mistrust, fear, and resentment, especially when “failures” are exposed or punished.<\/p>\n The compromise: Use simulations as a measurement tool (not a punishment tool), provide positive feedback for correct reporting, and use the results to improve technical controls – not to shame employees.<\/p>\n The most effective “awareness measure” is technical: DMARC on Enforce (prevents domain spoofing), MFA (makes stolen passwords useless), URL sandboxing (neutralizes malicious links), and Conditional Access (blocks logins from unusual contexts).<\/p>\n These measures catch human errors before they cause damage. The human remains the last line of defense – not the only one. Those who rely solely on human vigilance have already lost.<\/p>\n Training Effect:<\/strong> Less than 1 percentage point difference in phishing click rates (Proofpoint 2024)<\/p>\n Nudging Effect:<\/strong> 40-50 percent reduction through context-based email warnings<\/p>\n DMARC Adoption:<\/strong> Only 33 percent of German companies on Enforce (eco 2024)<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n No, but rethink it: Move away from annual mandatory videos to short, context-based micro-training sessions (5 minutes, monthly), use phishing simulations as a measurement tool, and rely on technical controls as the primary defense.<\/p>\n<\/details>\n In this order: DMARC on Enforce (domain protection), MFA for all services (credential protection), URL sandboxing in the email gateway (link protection), external sender tagging in the email client (context information).<\/p>\n<\/details>\n NIS2 requires “sensitization measures” – this doesn’t have to be a traditional training program. Verifiable micro-interventions, phishing simulations, and documented technical safeguards meet the requirement. The key is verifiability.<\/p>\n<\/details>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
\n
The Compliance Charade: Why Annual Training Doesn’t Work<\/h2>\n
What Works Instead: Nudging Over Training<\/h2>\n
Phishing Simulations: Helpful or Harmful?<\/h2>\n
Defense in Depth: Technical Controls as a Safety Net<\/h2>\n
Key Facts<\/h2>\n
Frequently Asked Questions<\/h2>\n
Should I completely abolish security awareness training?<\/strong><\/summary>\n
Which technical measures have the greatest impact?<\/strong><\/summary>\n
Are we still NIS2-compliant without traditional training?<\/strong><\/summary>\n
Related Articles<\/h2>\n
\n