Security Awareness Training: Why the Annual Module Is the Problem

The Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology with the Home Office in April 2026, surveyed 2,112 UK businesses and 1,085 charities. It found that 43% of businesses identified a breach or attack in the previous twelve months, which scales to roughly 612,000 organisations.

Phishing dominates that picture. It was identified by 38% of all businesses, and among organisations that were breached, 51% experienced phishing and nothing else, up from 45% the year before.

There is a useful contrast buried in the same data. Reported ransomware incidents sat at around 1% of businesses. The highest-frequency threat and the highest-impact threat are not the same thing, and a security programme built only around the dramatic scenario will leave the common one unaddressed.

The problem is structural rather than a matter of content quality.

Recall decays quickly. A module completed in January has largely faded by March. Attackers do not schedule around your training calendar, and the eleven months after the annual session are exactly when people are least prepared.

Completion is not comprehension. A pass mark on an end-of-module quiz measures whether someone could identify a phishing email when they knew they were being tested on phishing emails. That is a materially easier task than spotting one while rushing between meetings.

Generic content gets dismissed. Training that opens with a Nigerian prince and a spelling mistake teaches people to look for signals that modern phishing no longer contains. Attacks now use correct grammar, genuine branding, and increasingly AI-generated copy tailored to the recipient.

One session cannot cover changing tactics. The techniques that mattered eighteen months ago are not the techniques landing now. Anything delivered annually is describing last year’s attacks.

Programmes that move the numbers tend to share four characteristics.

Frequency over duration. Short and regular beats long and occasional. A few minutes every month outperforms an hour once a year by a considerable margin, because the point is keeping the pattern current rather than transferring a body of knowledge.

Simulation with measurement. Simulated phishing gives you a real behavioural measure rather than a completion statistic. What matters is the trend in click rate over months, and equally the reporting rate, which tells you whether people are actively flagging suspicious messages rather than quietly deleting them.

Targeting where the risk is. Finance staff face invoice fraud and payment redirection. Senior leaders face impersonation and whaling. Everyone else faces credential harvesting. Treating these as one audience wastes most people’s time and underprepares the ones at genuine risk.

Psychological safety. This one gets overlooked and it matters more than almost anything else. If clicking a simulation results in public embarrassment, people stop reporting real incidents because they fear the consequences. The gap between an incident being noticed and being reported is often where the actual damage happens, and a punitive culture widens it.

Training will not save you from a well-executed attack, and any provider claiming otherwise is selling something.

Awareness reduces how often someone clicks. It does not determine what happens once they do. That outcome is decided by technical controls, and the difference between a near miss and an incident is usually whether MFA was properly enforced rather than whether the individual had completed their training.

That is precisely what happened in the Microsoft 365 password spray campaign earlier this year. Attackers used credentials that already worked. In most of the compromised organisations MFA existed but was scoped too narrowly, so a working password was enough. No amount of awareness training addresses that, because the users involved did nothing wrong at the point of compromise.

The sensible reading is that training and technical controls do different jobs. Training reduces exposure. Controls limit consequence. An organisation with excellent training and badly scoped MFA is considerably more exposed than one with the reverse.

Four numbers tell you whether a programme is working:

• Click rate over time, tracked as a trend rather than a snapshot
• Reporting rate, and whether it is rising, which matters as much as clicks falling
• Time to report, because a fast report limits the damage window
• Repeat clickers, which usually indicates a targeting or format problem rather than an individual one

If a provider cannot show you these, they are selling completion certificates.

• Buying training to satisfy an insurer or a tender question, then being surprised it does not change behaviour
• Running simulations without measuring anything, which produces anxiety and no data
• Naming or disciplining people who click, which reliably suppresses reporting
• Excluding senior leaders, who are the most heavily targeted and frequently the least trained
• Treating the programme as complete once the first year is done

Start with a baseline simulation before any training, so you have something to measure improvement against. Most organisations skip this and then cannot demonstrate whether anything worked.