Security Awareness Training Isn’t Dead, but It Needs a Rethink

What it is

A SecurityWeek roundup of named practitioner and vendor opinions on why security awareness training fails, plus an interview with cognitive psychologist Jordan Richard Schoenherr (Humanix / UNSW) on the memory mechanics behind that failure.

How it works

Schoenherr frames the training problem as a memory-and-retrieval task: awareness training tries to write information into long-term memory and bind it to a correct behavioral response, but "forgetting (or entropy) is the default state of memory – and it occurs rapidly." Even retained knowledge often fails to activate in the moment, which is why behavioral nudges (context-triggered reminders) are proposed as a complement to one-off training. He also explains the brain mechanism behind predicting novel attack patterns: creative/predictive tasks pull memories from the inferior temporal lobe into the prefrontal cortex to build an "analogical" mental model of the situation — the same process an employee uses when judging whether a message is malicious. This model degrades as attackers introduce new variables, which is why trainers "are always fighting the last war." He recommends organizations borrow "decision-making under deep uncertainty": build many plausible future attack scenarios, simulate outcomes, and train toward the best-performing scenario rather than only known past patterns.

Preconditions / Affected

Applies to any organization relying primarily on periodic/annual phishing-recognition training rather than layered technical controls; the failure mode is sharpest where training content is static/compliance-mandated and not refreshed against current attack patterns.

What to do

The page's concrete recommendations: (1) shift measurement/reward toward a small set of specific behaviors — MFA usage and threat reporting — rather than generic completion metrics (Hoxhunt's Mike Aalto); (2) increase training frequency and refresh content to match evolving attacks rather than static annual modules; (3) add context-triggered behavioral nudges to reactivate training at the moment of decision, not just in the classroom; (4) apply "decision-making under deep uncertainty" — build multiple attack-scenario simulations and train against the best-performing scenario set; (5) treat training as reinforcement of technical architecture (identity protections, verification procedures, anti-phishing tooling), not a substitute for it.

Caveats

No studies, vendor names for the "14-fold AI-phishing surge" methodology, or scenario-simulation case studies are cited with specifics — the psychological mechanism and the deep-uncertainty framework are explained conceptually, not with a reproducible protocol. The piece itself concludes training "will never be perfect" and offers no metric for how much the recommended changes improve outcomes.