Cyber security awareness training statistics that matter
Not a hunch. Not an opinion. A randomised controlled study of 19,500 employees found annual cyber security training had no measurable impact on phishing susceptibility. Then somebody reproduced it across another 12,511. The data is in. Here's what it says.
The average difference in phishing susceptibility between employees who had completed annual cyber security training and those who hadn't. Not a typo. After all the modules, all the completions, all the certificates... 1.7%. That is not a training programme. That is an audit trail with a compliance budget attached.
Ho et al. (2025). UC San Diego / University of Chicago. Randomised controlled study, n=19,500 employees.Significant effects. That's what happened when the same test was run again across another 12,511 employees, at a different company, in a different sector, with a control group that got nothing at all. Not a small effect. None. No significant effect on how many people clicked, none on how many reported it, and effect sizes the researchers themselves call negligible. Their paper is titled Anti-Phishing Training (Still) Does Not Work.
Rozema & Davis (2025). arXiv preprint 2506.19899, v3 October 2025. n=12,511.Of UK businesses ran no staff training or awareness activity whatsoever last year. Not bad training. None. And the figure hasn't budged in a year. So before anyone concludes the industry has a quality problem, notice that it still has a turning-up problem.
Department for Science, Innovation and Technology (2026). Cyber Security Breaches Survey 2025/26. 2,112 UK businesses, 1,085 charities.The most rigorous study ever done on annual training found it doesn't work. Then it was done again.
The first study, published at the IEEE Symposium on Security and Privacy in May 2025, followed 19,500 employees at a large healthcare organisation for eight months, with randomised assignment, real phishing attempts and actual click data. Not a survey. Not self-report. Behaviour.
The difference between the trained and the untrained was 1.7%.
One study is arguable, and it should be. So six weeks later, in June 2025, two researchers at Purdue posted a large-scale reproduction: somewhere else entirely, with a control group, and this time scoring every fake email for how convincing it was against a standard scale published by NIST. They do not name the first study. Their abstract says their findings echo prior work, which makes these two independent teams reaching the same answer by different routes. Their finding, in their own words: "training interventions showed no significant main effects on click rates... or reporting rates, with negligible effect sizes."
What did predict clicking? How good the fake was. The most obvious ones caught 7.0% of people. The most convincing caught 15.0%.
Two studies, more than 32,000 employees, and the same answer. How good the attack was mattered. Whether people had been trained didn't.
The UK's own incident data. Same answer.
Of incidents at large organisations came in through just four routes. Two of them were phishing and the misuse of valid accounts.
NCSC Annual Review 2026, p15.Incidents the NCSC stepped in on this year. Lesson two of the seven it drew from them: "People remain a target."
NCSC Annual Review 2026, pp26, 28.Suspicious emails reported to the NCSC in twelve months, the highest since the service started.
NCSC Annual Review 2026, p49.“Strong cyber hygiene, informed and vigilant staff, effective monitoring and incident response, and resilient supply chains remain among the most effective ways to reduce cyber risk.”
NCSC Annual Review 2026, p27
Four findings the industry would rather not talk about
Completion rates measure attendance, not learning
61% of employees fail a basic security knowledge test after completing mandatory training. Not before. After. The module ran, the certificate was issued, the dashboard went green, and more than half of them can't answer seven basic questions. A completion rate tells you a video finished playing.
Epignosis (2023), n=1,200 US employees.
4% of your people are causing 80% of the phishing clicks
Risk does not spread evenly across a workforce, it clusters, and the concentration is far tighter than the familiar version of this statistic suggests.
The primary research, a Cyentia Institute study of 15.1 million security events across 168,000 users and more than 3,800 organisational departments over six years, found that 4% of users are responsible for 80% of the actual clicks of phishing emails that occur. Their words: it is "a little bit worse than just the 80/20 rule for phishing clicks, it's more like the 80/4 rule."
Malware is tighter still. 3% of users account for 92% of malware events, and 1% of those will average an incident every other week. Secure browsing: 12% of users, 71% of incidents.
The good news in the same dataset is worth saying: 76% of people have never clicked a phishing email, and 93% have never had a malware incident. Most of your workforce is not the problem.
Annual training reaches that 4% in exactly the same way it reaches the 76% who never needed it. Once, in a format they will forget, in a month they had no say in choosing. Uniform delivery cannot address concentrated risk, and a completion rate cannot even see it.
Cyentia Institute, "The Size and Shape of Workforce Risk", based on data provided by Elevate Security. 15.1m events, 168k users, 3,800+ departments, January 2016 to December 2021.
Social engineering is designed to bypass training, and it isn't only email any more
Social engineering exploits urgency, authority and trust, which are the same instincts that make people good colleagues. It doesn't wait for you to be alert. It arrives at 4pm on a Friday looking almost right.
It also stopped being one channel. Phishing arrives by email, smishing by text, vishing by phone, and the same attack now runs across all three. Social engineering is Verizon's third most common breach pattern in 2026, at 16% of all breaches.
And it has moved to the channels nobody rehearses. In phishing simulations, "the median rate of successful 'click' rates in mobile-centric vectors (such as voice and text messaging) is 40% higher than via email." Your people have practiced being suspicious of their inbox. Nobody has ever practiced being suspicious of their phone ringing.
The UK's National Cyber Security Centre reached the same place from its own casework. The second of its seven lessons from the 337 incidents it supported this year is "People remain a target": social engineering, credential theft, and "security culture matters". For large organisations, 88% of the incidents it handled came in through four routes, two of them phishing and the misuse of valid accounts. And its view of AI is that the greatest impact will be "the acceleration and scaling of existing" attack techniques, social engineering among them. The same attacks, arriving faster.
A module teaches recognition. Recognition is not the thing that fails.
Verizon (2026). Data Breach Investigations Report. · NCSC (2026). Annual Review 2026, pp15, 21, 28.
Frequency changes the numbers. Design changes them more.
Continuous simulation does move the figures. KnowBe4's 2026 dataset shows an average starting point of 33.2% of people clicking, falling to 20.1% after ninety days and 4.2% after twelve months.
Worth knowing how that gets delivered, though, because the intuitive design is the weak one. Three randomised field experiments published in MIS Quarterly found that training delivered at the point of failure, to the people who clicked, "appears effective in laboratory settings but shows mixed or negative results in real-world implementations", partly because people get defensive when they've just been caught. Delayed feedback, sent to everybody rather than only the failures, worked better. Their conclusion: "Training does not need to be delivered at the point of failure to be effective."
So the answer is more often, to everyone, without the ambush.
KnowBe4 (2026). Phishing by Industry Benchmarking Report, 7 July 2026. · Yin, D. et al. (2026). MIS Quarterly, 50(2), 767-784, published 31 May 2026.
Annual training makes no measurable difference. Two studies, thirty-two thousand people, one answer.
In March 2026 the US Army cut mandatory cyber security training from annual to once every five years. Not because they stopped caring about cyber security. Because the annual model wasn't doing anything, and pretending otherwise cost them time they needed elsewhere.
That is the most honest thing any large organisation has done with this evidence.
The gap isn't between organisations that train and those that don't. It's between formats.
Every organisation we walk into has content. Modules, posters, an intranet page, a policy nobody has opened since induction. The library is almost never the gap.
What they don't have is a single occasion in the year where their people make a security decision under time pressure, in front of colleagues, and then find out what it cost them.
That is the difference between knowing and doing. Your people already know not to click the link. They knew last year too.
Research sources (9)
- Ho, G. et al. (2025). Understanding the Efficacy of Phishing Training in Practice. IEEE Symposium on Security and Privacy, May 2025. UC San Diego / University of Chicago. n=19,500.
- Rozema, A.T. & Davis, J.C. (2025). Anti-Phishing Training (Still) Does Not Work: A Large-Scale Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale. arXiv:2506.19899. Purdue University. v1 submitted 24 June 2025, v3 13 October 2025. n=12,511. CC BY-NC-SA 4.0.
- Department for Science, Innovation and Technology (2026). Cyber Security Breaches Survey 2025/26. UK Government official statistics, 30 April 2026.
- Verizon (2026). Data Breach Investigations Report. Published 19 May 2026.
- KnowBe4 (2026). Phishing by Industry Benchmarking Report. Published 7 July 2026.
- Yin, D., Mullarkey, M.T., de Vreede, G-J. & Limayem, M. (2026). Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training. MIS Quarterly, 50(2), 767-784. Published 31 May 2026.
- Epignosis (2023). Cybersecurity Training Survey. n=1,200 US employees.
- DefenseScoop (2026). US Army reduces mandatory cybersecurity training to once every five years. March 2026.
- NCSC (2026). Annual Review 2026: The State of the Cyber Nation. National Cyber Security Centre.
Your people deserve more than a module.
Your people deserve more than a module. If any of this research has landed, let's talk about what a different approach looks like for your organisation.