Initializing secure session…Initializing secure session…Ninety-eight percent of staff completed the annual module. The phishing click rate did not move. If that sounds familiar, the program is measuring the wrong thing.
Most security-awareness programs are designed to produce a number: the percentage of staff who completed the training. Auditors accept it, insurers ask for it and leadership is reassured by it. It tells you almost nothing about whether the organisation is safer.
Completion measures attendance, not behavior. A nurse who clicked through forty slides between patients, a driver who watched a video on a phone at a loading dock, a partner whose assistant completed it for them — all count as trained. None of them will necessarily pause before approving a wire transfer or opening an attachment from a "supplier."
The attacks that succeed against organisations are overwhelmingly human: credential phishing, business-email compromise, pretexting calls to the help desk. Training that does not change what people do in those moments is a compliance artefact, not a control.
Did the phishing-simulation click rate fall? Did reporting of suspicious messages rise? Did finance staff verify the last three payment-change requests by phone? Did the help desk refuse the last pretexting call? These are behaviors, and they can be measured.
A module written for "all employees" speaks to no one. A hospital's risk lives in shift pressure and shared workstations. A construction firm's risk lives in payment approvals and site devices. A law firm's risk lives in client confidentiality and wire instructions. Training that reflects the actual job, the actual threats and the actual tools lands. Training that does not is forgotten before lunch.
People do not remember training. They remember the moment it was obviously about them.
Staff across every industry are already using generative AI tools, with or without permission. Training that explains what the organisation allows, what data must never be entered, and how to use these tools well is now as important as phishing awareness — and far rarer. It belongs in the same program.
We deliver security and AI-literacy training directly to organisations and through the Rotary IT Professionals Forum Fellowship, always built around the audience's actual work. If your completion rate is high and your confidence is not, that is the program we would rebuild.
This article is general information for business readers, not legal, regulatory, medical or professional advice. Regulations change; confirm requirements for your situation with qualified counsel or your regulator. Imagery is original AI-generated artwork created with Canva. Frameworks and standards named are trademarks of their respective owners.
The difference between an AI program that scales and one that gets shut down after its first incident is rarely the model. It's whether anyone's name is on it.
Read the article →
Zero trust is sold as an architecture overhaul. For most mid-sized organisations it is better understood as a set of decisions about identity, access and assumptions — most of which cost less than the breach they prevent.
Read the article →
Most organisations under a few hundred people do not need a full-time chief information security officer. Many of them badly need the function. Here is how to tell which you are.
Read the article →Start with a free security or AI readiness call — no obligation, and you leave with a clear next step.