The Knowledge Gap

Executive summaryThe problem is not that employees don't care. It is that what we teach them does not survive contact with the attack.

Security awareness training is now near-universal, mandated by at least eight major regulatory regimes, and funded in almost every enterprise security budget. Over the same period, the share of breaches involving a human being has not fallen. In the 2026 Verizon dataset it rose — from 60% to 62%.¹ That gap between effort and outcome is the subject of this paper.

None of this argues for abandoning employee education. It argues that the dominant delivery model — an annual compliance module plus a punitive phishing simulation — is measuring completion rather than capability, and that the published evidence does not support the outcomes attributed to it. The organisations that reduce human risk treat it as a control domain with owners, telemetry, and a decay schedule, not as a training obligation with a due date.

Sections 1 through 4 establish the exposure. Section 5 examines what the peer-reviewed literature actually finds about awareness training, including the counter-evidence. Sections 6 through 9 set out a compliance baseline, seven design principles drawn from that evidence, a measurement set that replaces click rate, and a twelve-month sequence a security leader can put in front of a board.

"Anti-phishing training programs, in their current and commonly deployed forms, are unlikely to offer significant practical value in reducing phishing risks."

Ho et al., IEEE Symposium on Security and Privacy, 2025 — randomised trial, 19,500 employees

Section 01The human element has not moved in five years

A stable statistic in a market that has spent heavily to change it.

The Verizon Data Breach Investigations Report is the closest thing the industry has to a longitudinal, multi-contributor breach census. Its 2026 edition analysed more than 31,000 security incidents and more than 22,000 confirmed breaches across 145 countries.¹ Its headline number for human involvement — errors, misuse, stolen credentials, and social engineering combined — was 62%, described in the report as a slight increase on the prior year's 60%.

This figure has hovered in the same band for half a decade. It has done so through a period in which security awareness training became a mandatory control under PCI DSS, NYDFS Part 500, DORA and NIS2; in which simulated phishing became standard practice; and in which the global market for awareness products grew substantially. Whatever the industry has been buying, it has not moved this number.

What changed underneath a stable number

The stability of "62%" conceals substantial movement in composition. Three shifts matter for anyone designing a human-risk programme.

Vulnerability exploitation overtook credential abuse as the leading initial access vector, rising from 20% to 31%.¹ This is often read as good news for the human-risk story — the machines are the problem now. It is not. Exploitation gets an attacker onto the network; it rarely gets them the data. In Mandiant's 2025 casework, the median time between an initial-access broker's entry and hand-off to a second threat actor fell from more than eight hours in 2022 to 22 seconds in 2025.⁷ Post-exploitation, the actor still has to move laterally, escalate, and persuade someone to approve something.

Third-party involvement in breaches rose from 30% to 48% — a 60% year-over-year increase.¹ Nearly half of breaches now involve a supplier, contractor, or integration partner. The practical consequence for a CISO is that the organisation's human-risk posture is now partly a function of training programmes it does not run and cannot audit directly. Ransomware, meanwhile, appeared in 48% of breaches, up from 44% — but ransomware is a monetisation model, not an entry method, and the entry is increasingly a person.¹

• 62%of breaches involve the human element (2026, from 60%)
• 48%of breaches involve a third party (2026, from 30%)
• 16%of breaches begin with phishing — unchanged year on year
• 6%of breaches begin with pretexting, including BEC

The insurance market reached the same conclusion independently

Underwriters see a different slice of the same problem: not incidents, but paid losses. The cyber insurer Resilience reported that more than 85% of incurred cyber losses in the first half of 2026 stemmed from attacks that exploited human error, and that the share of incurred losses attributable to phishing, social engineering and transfer fraud rose from 17.7% in H1 2024 to 85.3% in H1 2026 — the largest single movement among loss drivers it tracks.¹²

Coalition's 2025 claims data points the same way from a different portfolio: business email compromise and funds-transfer fraud together accounted for 60% of all claims, with average BEC severity up 23% year on year to roughly $35,000, and 29% of BEC events escalating into a funds-transfer-fraud event averaging $106,000.¹³

Nearly half of breaches now involve a third party. An organisation's human-risk posture is increasingly a function of training programmes it does not run.

Why "the human element" is the wrong unit of analysis

The 62% figure is useful as a headline and almost useless as a management target, because it aggregates behaviours with nothing in common. A finance clerk approving a fraudulent payment after a deepfaked video call, a developer pasting a customer table into a public chatbot, a help-desk agent resetting MFA for an impersonator, and an administrator misconfiguring a storage bucket are four different failures with four different causes and four different fixes. Training all four with the same annual module is a category error.

Section 3 proposes a taxonomy that separates them. First, though, it is worth being precise about what employees are now facing — because the attack has changed considerably faster than the curriculum. It is also worth noting that insurers, who price risk they must pay for, have reached the same conclusion from two independent claims portfolios.

Section 02How employee-targeted attacks changed, 2024–2026

Five shifts that most awareness curricula have not caught up with.

2.1 The channel moved from the inbox to the phone line

The most consequential change in this period is that the highest-value social engineering stopped arriving by email. Mandiant's M-Trends 2026, based on 2025 incident-response engagements, found voice phishing to be the second most common initial infection vector at 11% of investigations — behind exploits at 32%, but ahead of email phishing, which fell to 6% from 22% in 2022 and 14% in 2024.⁷ CrowdStrike had recorded a 442% increase in vishing between the first and second halves of 2024.⁸

Two things drive this. Voice is far harder for technical controls to inspect than email — no gateway, no attachment sandbox, no URL rewriting on a phone call — and it is far better suited to the real-time, adaptive pressure that gets a person to override a process.

IBM's cost data reflects the difference in outcome: vishing and smishing produced the highest average cost of any entry point at $5.29M, against a global all-cause average of $4.99M.³ Verizon's simulation telemetry shows the same asymmetry — mobile-centric lures achieved click success roughly 40% higher than equivalent email lures.¹ Almost no annual awareness curriculum trains for an inbound phone call. Almost every one trains for a suspicious email.

2.2 The help desk became an initial access vector

The clearest illustration is the 2025 UK retail campaign against Marks & Spencer, Co-op and Harrods. The UK National Cyber Security Centre's account of the tradecraft is unusually direct: attackers gathered employee information from social media, executed SIM-swap fraud, then impersonated those employees to internal IT help desks and used intercepted authentication codes to complete password resets.⁹ No malware was required. The control that failed was an identity verification procedure executed by a human being under time pressure. The financial consequence is public record: in its half-year results for the 26 weeks ended 27 September 2025, Marks & Spencer reported statutory profit before tax of £3.4M against £391.9M the prior year, including roughly £102M of one-off attack costs with a further £34M expected in the second half, partly offset by a £100M insurance payout.¹⁰

The same playbook recurred across US insurance and aviation through 2025, and in voice-phishing campaigns against Salesforce environments in which employees were persuaded by phone to authorise a malicious connected application into their organisation's tenant.²⁷

2.3 AI is an amplifier of social engineering, not a replacement for it

The 2026 DBIR's assessment is measured and worth quoting in substance: the median malicious actor observed using AI applied it across roughly 15 distinct documented attack techniques, and 44% of identified AI-assisted initial access was phishing-related — but under 2.5% of AI-assisted techniques were genuinely novel.¹ Attackers are not inventing new attacks with AI. They are producing existing attacks in greater volume, in more languages, with fewer of the errors that awareness training taught people to look for.

IBM found roughly one in four malicious breaches in its 2026 study were AI-enabled — a 56% increase year on year — at an average cost of about $6M, roughly $1M more than a comparable non-AI breach.³ CrowdStrike recorded an 89% year-over-year increase in AI-enabled adversary operations and a 563% increase in incidents using fake-CAPTCHA lures.²⁸ Two incidents are unusually well documented: the 2024 Arup case, in which a finance employee in Hong Kong transferred approximately US$25M after a video conference in which the CFO and colleagues were deepfakes;²⁹ and Anthropic's November 2025 disclosure of a state-attributed campaign in which it assesses 80–90% of tactical operations were executed autonomously by an AI agent against roughly 30 target organisations.³⁰

The implication for training content is narrow but important: the heuristics awareness programmes spent fifteen years teaching — poor grammar, odd formatting, generic salutations, an implausible sender — are now the weakest available signals. Guidance built on "spot the tell" is being actively obsoleted. Guidance built on "verify through a second channel you initiated" is not.

Under 2.5% of AI-assisted attack techniques observed in the 2026 DBIR were genuinely novel. AI is not producing new attacks; it is removing the flaws that awareness training taught people to look for.

Verizon, 2026 Data Breach Investigations Report

2.4 Shadow AI arrived faster than any training cycle

Between the 2025 and 2026 DBIR editions, the proportion of employees regularly using generative AI on corporate devices rose from 15% to 45%. Of those users, 67% were accessing the tools through non-corporate accounts, placing the activity outside enterprise logging, retention and DLP. Shadow AI policy violations became the third most common non-malicious insider action, rising roughly fourfold.¹

The independent survey evidence explains why. In the National Cybersecurity Alliance and CybSafe Oh Behave! study of more than 6,500 people across seven countries, 65% reported using AI tools, 58% had received no security or privacy training on AI use, and 43% admitted sharing sensitive workplace information — internal documents, financial data, client information — with an AI tool without employer approval.¹¹ Netskope recorded generative-AI data-policy violations more than doubling across 2025, averaging 223 per organisation per month.³¹

IBM quantifies the consequence: shadow AI figured in 43% of security incidents in its 2026 study, causing data loss in roughly half of those cases, and 92% of organisations lacked adequate access controls around their AI systems.³ This is a useful test case for any human-risk programme, because it is a gap with a known creation date. An organisation that took twelve months to publish AI guidance was, by construction, twelve months late. Programmes designed on an annual cadence cannot respond to a capability that reaches half the workforce in a year.

2.5 Third parties inherit — and export — knowledge gaps

With third-party involvement in 48% of breaches,¹ the boundary of a human-risk programme no longer matches the boundary of the payroll. The 2025 Salesloft Drift incident is instructive: attackers obtained OAuth and refresh tokens for a widely-deployed integration and used them to exfiltrate data from customers' connected SaaS environments — exposing hundreds of organisations through a trust relationship none of their own employees had done anything wrong to create.³²

The corresponding control is contractual, not educational: require evidence of an awareness and phishing-resistance programme from suppliers with production or identity access, and treat it as a reviewable artefact rather than a questionnaire checkbox. DORA takes this position explicitly.³⁴

Section 03A taxonomy of employee knowledge gaps

Seven distinct failure modes that a single annual module treats as one.

"Human error" is not a diagnosis. It is the point at which diagnosis stopped. The taxonomy below separates the employee-mediated failures that appear in the incident data into seven classes, each with a different root cause and therefore a different remedy. The value of the split is operational: it tells a security leader which gaps are training problems, which are process problems, and which are design problems that no amount of training will fix.

Mapping gaps to the control that actually closes them

The reason to draw these distinctions is that only two of the seven are primarily training problems.

Gaps 01 and 04 respond to training. Gaps 02, 03, 05, 06 and 07 respond to process, governance, cadence, culture and engineering respectively. A programme that treats all seven as a content problem will under-deliver against five of them regardless of the quality of the content.

Section 04Quantifying the exposure

Putting a defensible number on human risk without inventing one.

Boards fund what they can size. The difficulty with human risk has always been that the credible loss data is aggregate while the organisation-specific data is thin. What follows is the published baseline, a method for turning it into an internal estimate that survives challenge, and an explicit account of what that method cannot tell you.

4.1 The published loss baseline

IBM and the Ponemon Institute's 2026 study of 602 organisations, covering incidents between March 2025 and February 2026, put the global average total cost of a data breach at US$4.99M — a 12% year-on-year increase and a record high — with the United States average at $11.5M.³ Mean time to identify and contain rose to 247 days, reversing five consecutive years of improvement.

Phishing led all entry points for the fourth consecutive year. Vishing and smishing produced the highest average cost of any single vector at $5.29M.³

The FBI's Internet Crime Complaint Center recorded 1,008,597 complaints in 2025 with total reported losses of $20.877 billion. Business email compromise alone accounted for 24,768 complaints and $3.046 billion, with a further 191,561 complaints categorised as phishing or spoofing.⁴ IC3 figures represent only what was reported to the FBI and are therefore a floor, not an estimate of true loss.

4.2 Insider risk: the majority of loss is not malicious

The Ponemon Institute and DTEX Systems 2026 insider-risk benchmark, covering 354 organisations and 7,490 incidents, puts the average annual cost of insider risk at US$19.5M globally and $24M in North America. Critically for programme design, 53% of incidents were attributed to negligent or mistaken insiders, 27% to malicious or criminal insiders, and 20% to credential theft.⁵

The containment differential is the most actionable number in that report: a $7.7M annual gap between fast and slow containment is largely a reporting-speed problem, addressable through the mechanisms in gap 06.

4.3 Building an internal estimate

The following structure produces a defensible internal figure. It is deliberately simple, because elaborate models invite argument about parameters rather than agreement about direction.

Annual expected loss ≈ (1 × 2 × 3) × (1 − 4) × 5. The output is a range, not a point. Present it as one.

4.4 The concentration insight

Two independent datasets suggest human risk is concentrated rather than distributed. Verizon's 2025 analysis found that 8% of employees consistently account for the large majority of insecure data access and sharing incidents.² The ETH Zurich longitudinal study found that among employees who clicked at least one simulated phish, 30.6% went on to click two or more, and 23.9% took a dangerous action more than once.¹⁶

A programme that spends uniformly across the workforce spends most of its budget on people who were never going to fail, and under-serves the roles that carry the risk. Segmenting by measured susceptibility and by entitlement is the single highest-leverage change available to most programmes.

Section 05What the evidence says about awareness training

The peer-reviewed literature is less flattering than the industry literature. Both are presented here.

Security awareness training is a mature market with a well-developed set of claims about its effectiveness, most of which originate from the organisations selling it. Over the last four years a body of independent, peer-reviewed field research has accumulated that tests those claims directly. A security leader deciding where to spend should know what it found.

5.1 The randomised trials find little to no behavioural effect

The most rigorous study to date was conducted at UC San Diego Health and published at the 2025 IEEE Symposium on Security and Privacy. Researchers embedded a randomised controlled trial inside the organisation's live phishing-training programme: approximately 19,500 employees, eight months, ten distinct simulated phishing campaigns.¹⁴ Its findings:

• No significant relationship between having recently completed the annual mandated cybersecurity training and the likelihood of clicking a phishing link.
• Embedded "teachable moment" training, delivered immediately after a simulated click, reduced future click risk by approximately 2%.
• 75% of users who received embedded training engaged with the material for one minute or less; roughly one-third closed it without engaging at all.
• Susceptibility accumulated rather than declined: around 10% of users clicked in month one, and by month eight more than 50% had clicked at least once.
• Lure content dominated outcomes. An Outlook password-reset lure drew a 1.82% click rate; a vacation policy update drew 30.8%.

The authors' conclusion, stated in the paper, is that anti-phishing training in its current and commonly deployed forms is unlikely to offer significant practical value in reducing phishing risk.

This result has been independently reproduced. Researchers at Purdue ran a randomised trial across 12,511 employees at a US fintech firm, comparing lecture-only training, lecture-plus-interactive training, and no training, with lure difficulty controlled using the NIST Phish Scale. They found no statistically significant improvement in click rate (p = 0.450) or reporting rate (p = 0.417), with negligible effect sizes. Lure difficulty was the dominant predictor: click rates rose from 7.0% on easy lures to 15.0% on hard ones.¹⁵

Both align with the earlier ETH Zurich study — 14,733 employees, fifteen months, 117,864 simulated emails — which concluded that embedded training as commonly deployed does not make employees more resilient and can produce unintended side effects.¹⁶

5.2 What training does achieve decays within six months

The countervailing evidence is that training does produce a measurable short-term effect — it simply does not persist. A field study at a German state authority, published at USENIX SOUPS, tracked 409 employees for a full year using signal-detection sensitivity (d′) as the measure of phishing-detection skill.¹⁷

This is the most useful single finding in the literature for programme design, because it converts a vague intuition ("training should be more frequent") into a specific parameter. An annual cadence leaves roughly half the year with no measurable residual effect. The decay curve, not the compliance calendar, should set the schedule.

5.3 Habituation and security fatigue are measurable, not metaphorical

Two independent research traditions explain why repetition alone does not solve decay. Functional MRI work presented at ACM CHI found a sharp drop in visual-processing activity after only the second exposure to an identical security warning, worsening with further repetition — and that polymorphic warnings, which vary their appearance, substantially resist this habituation.¹⁸ Repeating the same message in the same format is neurologically self-defeating.

NIST's qualitative study of security fatigue found that more than half of participants raised fatigue spontaneously, without prompting, and documented the resulting posture: resignation, a sense of lost control, fatalism, risk minimisation and decision avoidance.¹⁹ A workforce in this state is not under-informed. It is over-asked.

5.4 The knowledge–behaviour gap

Underlying all of this is a finding that runs through the usable-security literature: knowledge is a weak predictor of behaviour. A systematic review of 142 cybersecurity training studies found that while 62 of the empirical studies reported positive effects, the median sample was 96 participants, most tested training only once before measuring, most measured knowledge or intentions rather than behaviour, and only 26 of the 142 grounded their design in an established behavioural theory.²⁰ The evidence base is not merely mixed; it is methodologically thin in exactly the place that matters.

Research on reporting behaviour points the same way. A 2025 cross-national study across Germany, the UK and the US found that the quality of security-related communication was a stronger predictor of phishing-reporting behaviour than knowledge was.²¹

Training produces a measurable effect that disappears in six months, on a threat that changes in six weeks, delivered on a twelve-month cycle. The arithmetic, not the content, is the problem.

5.5 The counter-evidence, stated fairly

It would be dishonest to present only the null results. Three lines of evidence point the other way.

Sustained, high-frequency programmes beat one-off training. A twelve-month study across 20 organisations and 1,300+ employees, using 13,000+ simulated emails, reported that sustained simulation with targeted training halved successful compromise rates within six months.²³ Note the design difference — continuous, not annual — which is consistent with the decay findings, not contrary to them.

Vendor benchmark data shows large susceptibility reductions. KnowBe4's 2026 benchmarking report, drawn from 42 million simulated exercises across 14.8 million employees at 64,000 organisations, reports a global baseline phish-prone percentage of 33.2%, falling to 20.1% after 90 days and 4.2% after twelve months.²⁴ This is by far the largest dataset available on the question, and it carries three caveats: it is vendor-produced and vendor-analysed; there is no untrained control group, so the effect of training cannot be separated from the effect of repeated exposure to simulations; and organisations still enrolled after a year are self-selected for commitment. The measured construct — susceptibility to that vendor's simulations — is also not susceptibility to real attacks.

Reporting, as distinct from detection, responds well. The ETH Zurich researchers found crowdsourced employee reporting to be an effective and sustainable mechanism for detecting live phishing campaigns, even as they found embedded training ineffective at reducing clicks.¹⁶ This is the strongest positive finding in the independent literature, and it points at a different programme objective than the one most organisations pursue.

5.6 What this does and does not mean

None of this means awareness training is worthless or should be cut. It is a regulatory requirement in most sectors (Section 6), a prerequisite for several classes of technical control, and the counter-evidence above shows sustained programmes outperform episodic ones. It does mean four specific things:

1. Budget annual compliance training as compliance, not as risk reduction. The randomised evidence does not support a risk-reduction claim for it, and a claim the evidence cannot support is a liability in front of a board or a regulator.
2. Click rate is a poor primary metric. It is dominated by lure difficulty rather than workforce capability,¹⁵ so a programme can improve it by choosing easier lures.
3. Punitive simulation programmes are counter-productive. Punishment discourages the reporting of real attacks — the behaviour with the strongest supporting evidence.²² A USENIX Security study of a 16,000-employee campaign measured the cost directly: employees who clicked reported higher stress (5.40 of 10) and lower self-efficacy (3.56 of 5) than those who reported the email (3.39 and 4.1), while 83.6% still rated the campaign worthwhile — so buy-in is not what is being traded away.²⁵
4. Cadence and targeting matter more than content quality. Given decay at six months and concentration in 8% of employees,^{2, 17} the same budget spent more often on fewer people beats it spent annually on everyone.

Section 06The compliance floor — and why it is only a floor

Where employee training is legally required, and what regulators have actually enforced.

Security awareness training is now an explicit obligation across most major regulatory regimes a large organisation operates under. The table below gives the specific provision, what it requires, and its effective date, so that a programme can be mapped against it directly.

Regulatory status was verified as of July 2026. The HIPAA Security Rule NPRM and a pending petition to amend the SEC incident-disclosure requirement were both unresolved at that date; confirm current status before relying on either.

Regulators have enforced on training specifically

Two cases show that inadequate training is treated as a substantive failure rather than a paperwork one.

In October 2022 the UK Information Commissioner's Office fined Interserve Group Ltd £4.4 million after a phishing email led to a malware compromise exposing the personal data of up to 113,000 current and former employees. The ICO's published findings cited outdated software, inadequate monitoring, and a failure to properly train staff. Information Commissioner John Edwards's framing is worth noting: "The biggest cyber risk businesses face is not from hackers outside of their company, but from complacency within their company."³⁶

In August 2025 the US Department of Health and Human Services Office for Civil Rights settled with BST & Co. CPAs for $175,000 following a ransomware attack that began with phishing. Beyond the monetary settlement, the corrective action plan required security-awareness training tailored to the organisation and to workforce job duties — a regulator prescribing training design, not merely training existence.²⁶

Cyber insurance treats it as an underwriting control

Awareness training and phishing simulation are now standard screening items on cyber insurance applications, alongside MFA, EDR and offline backups. Insurers ask whether a formal programme exists, at what frequency, and whether simulation testing is performed. Given the claims composition described in Section 1 — BEC and funds-transfer fraud at 60% of Coalition's claims,¹³ human-error-driven attacks at over 85% of Resilience's incurred losses¹² — this is unlikely to relax.

Section 07Designing for behaviour, not recall

Seven principles that follow from the evidence rather than from convention.

Each principle below is derived from a specific finding in Sections 2 and 5. None requires a particular product; all require a decision about how the programme is structured and who owns it.

A maturity ladder

The SANS 2025 Security Awareness Report, surveying more than 2,700 practitioners across 70+ countries, found 80% ranking social engineering as their top human risk and identified staffing thresholds of roughly 2.8 FTE to influence behaviour and 4+ FTE to shift culture. This is practitioner survey data, not a controlled study, and should be read as a benchmark rather than a causal finding.³⁵

Section 08Measuring what matters

Replacing metrics that can be gamed with metrics that predict outcomes.

A measurement set is a statement about what a programme is for. Completion rate says it exists to satisfy an auditor. Click rate says it exists to reduce a number the programme itself controls, since the programme chooses the lures. The set below is built around behaviours the evidence shows to be consequential.

What to retire, and how to say so

Completion rate should be retained for audit and removed from the risk dashboard; it measures administration. Click rate should be demoted from headline to diagnostic — the Purdue reproduction showed it moving from 7.0% to 15.0% on lure difficulty alone with no significant training effect,¹⁵ so a falling click rate reported without holding difficulty constant is not a defensible claim of improvement. If it is reported, report the Phish Scale difficulty alongside it. Vendor phish-prone benchmarks are useful for orientation and unsuitable as a target, for the reasons in Section 5.5.²⁴

Section 09A twelve-month roadmap

Sequenced so that each quarter produces evidence the next quarter depends on.

What to do in the first thirty days

1. Call your own help desk. Have someone the agents do not know attempt a credential reset using only information available from LinkedIn and the corporate website. That single test will tell you more than a quarter of simulation data.
2. Measure report rate and time-to-first-report on your next campaign and put them on the same slide as click rate. If report rate is not instrumented, that is itself the finding.
3. Ask when your AI guidance was published relative to when AI use reached half your workforce. That difference is your guidance latency, and probably your largest current gap.
4. Check whether your simulation programme has consequences attached. If failing twice notifies a manager, you have a reporting-suppression mechanism working against the behaviour with the best evidence behind it.

ConclusionTreat human risk as a control domain, not a training obligation

The evidence assembled here supports an uncomfortable but useful conclusion: the industry has been buying the wrong thing, measuring it with the wrong metric, and delivering it on the wrong schedule — and the breach data has been saying so, consistently, for five years.

The 62% figure has not moved because the dominant intervention is aimed at only one of seven distinct failure modes, and does not survive six months even against that one. Meanwhile the attack has moved to channels most curricula do not cover, aimed at roles most programmes do not segment, using tools that remove the tells most content still teaches.

The path forward is not more training. It is a different structure: cadence set by measured decay rather than by the compliance calendar; targeting set by entitlement and observed behaviour rather than by headcount; content built around a verification procedure that transfers across channels rather than around recognition cues that AI has obsoleted; a help desk engineered as a control; reporting treated as the primary behaviour and never punished; and a measurement set a board can interrogate without the answers falling apart.

None of that is exotic, and most of it is cheaper than what it replaces. What it requires is a willingness to separate the compliance obligation from the risk-reduction objective, fund them differently, and stop claiming that the first accomplishes the second.

Compliance answers the question "did we train them?" Risk answers the question "would they verify?" Only one of those has ever stopped a breach.

ReferencesSources

1. verizon.com/business/resources/reports/dbir/
2. verizon.com/business/resources/reports/2025-dbir-executive-summary.pdf
3. ibm.com/reports/data-breach
4. ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
5. ponemon.dtex.ai
6. unit42.paloaltonetworks.com/2025-unit-42-global-incident-response-report-social-engineering-edition/
7. cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
8. crowdstrike.com/en-us/press-releases/crowdstrike-releases-2025-global-threat-report/
9. UK National Cyber Security Centre, reported commentary on the 2025 UK retail intrusions (M&S, Co-op, Harrods), including SIM-swap and help-desk impersonation tradecraft. 2025.
10. Marks and Spencer Group plc. Half-year results for the 26 weeks ended 27 September 2025, published 6 November 2025.
11. staysafeonline.org/press/study-65-now-use-ai-but-majority-remain-untrained-on-risks
12. claimsjournal.com/news/national/2026/07/30/339184.htm
13. coalitioninc.com/blog/cyber-insurance/2025-cyber-claims-report
14. G. Ho, A. Mirian, E. Luo, K. Tong, E. Lee, L. Liu, C. A. Longhurst, C. Dameff, S. Savage, G. M. Voelker. "Understanding the Efficacy of Phishing Training in Practice." 46th IEEE Symposium on Security and Privacy, 2025. ~19,500 employees; 8 months; 10 campaigns.
15. arxiv.org/abs/2506.19899
16. arxiv.org/abs/2112.07498
17. usenix.org/system/files/soups2020-reinheimer_0.pdf
18. B. B. Anderson, C. B. Kirwan, J. L. Jenkins, D. Eargle, S. Howard, A. Vance. "How Polymorphic Warnings Reduce Habituation in the Brain — Insights from an fMRI Study." ACM CHI 2015.
19. csrc.nist.gov/pubs/journal/2016/09/security-fatigue/final
20. J. Prümmer, T. van Steen, B. van den Berg. "A systematic review of current cybersecurity training methods." Computers & Security 136, art. 103585, 2023. 142 papers reviewed.
21. G. Petrič and J. N. Just. "Information security culture and phishing-reporting model: structural equivalence across Germany, UK and USA." Journal of Cybersecurity 11(1), Oxford, 2025.
22. B. Krebs. "Should Failing Phish Tests Be a Fireable Offense?" Krebs on Security, 2019 — practitioner commentary from PhishLabs and Cofense on reporting suppression. See also J. Budge et al., "Rotten Phish Spoils Employee Experience," Forrester, 2020.
23. arxiv.org/html/2510.27298v1
24. KnowBe4. 2026 Phishing by Industry Benchmarking Report. 42 million simulated exercises; 14.8 million employees; 64,000 organisations. Vendor-produced and vendor-analysed; no untrained control group.
25. M. Schöps, M. Gutfleisch, E. Wolter, M. A. Sasse. "Simulated Stress: A Case Study of the Effects of a Simulated Phishing Campaign on Employees' Perception, Stress and Self-Efficacy." 33rd USENIX Security Symposium, 2024. 16,000+ employee organisation; 408 questionnaire responses.
26. US Department of Health and Human Services, Office for Civil Rights. Settlement with BST & Co. CPAs, LLP, $175,000 with corrective action plan, August 2025.
27. Google Threat Intelligence Group. Reporting on UNC6040 voice-phishing campaigns against Salesforce environments, June 2025, and subsequent disclosures, August 2025 – January 2026.
28. crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/
29. CNN. "Arup revealed as victim of $25 million deepfake scam," 16 May 2024. Incident occurred January 2024 in Hong Kong.
30. anthropic.com/news/disrupting-AI-espionage
31. Netskope Threat Labs. Cloud and Threat Report 2026. January 2026. Vendor telemetry.
32. Reporting on the Salesloft Drift OAuth token compromise (UNC6395), August–September 2025, including Google threat-intelligence advisories and FBI indicators of compromise released 12 September 2025.
33. Microsoft. Microsoft Digital Defense Report 2025, and "Think before you ClickFix," Microsoft Security Blog, 21 August 2025.
34. Regulation (EU) 2022/2554 (DORA) Art. 13(6); Directive (EU) 2022/2555 (NIS2) Arts. 20 and 21; Regulation (EU) 2024/1689 (AI Act) Art. 4; PCI DSS v4.0.1 Reqs. 5.4.1 and 12.6; 23 NYCRR 500.14(a)(3); 45 CFR 164.308(a)(5); ISO/IEC 27001:2022 Annex A 6.3 and Cls. 7.2–7.3; NIST CSF 2.0 PR.AT and NIST SP 800-50r1 (2024); GDPR Arts. 32 and 39(1)(b); SEC Reg. S-K Item 106 and Form 8-K Item 1.05.
35. SANS Institute. 2025 Security Awareness Report (10th anniversary edition), August 2025. Survey of 2,700+ practitioners across 70+ countries. Practitioner survey data, not a controlled study.
36. UK Information Commissioner's Office. Monetary penalty notice, Interserve Group Ltd, £4.4 million, October 2022.