Our position · awareness and process
Every year, the same scene: a forty-minute module, a quiz passed, a certificate filed for the auditor. Box ticked. Then, a few months later, an employee gets a call from "IT support", follows the procedure the caller describes, and the attacker is signed in before the employee hangs up. The incident report concludes: human error. And a refresher course is scheduled.
Our position is simple, and uncomfortable: annual awareness training, on its own, protects no one. It proves to an auditor that you trained. It does not prove that your organization holds. What protects are processes that do not depend on an employee's vigilance on a Tuesday afternoon, and short, frequent exercises that look like real attacks.
Let us be clear about what we are not saying. We are not saying training is useless. We are saying the annual module has become an alibi: it lets us blame the employee for what is, almost always, a process failure. This is a position, not a settled truth, and we wrote it to be debated.
What the data says
One of the largest controlled studies on the subject was run at UC San Diego Health and presented at the IEEE Symposium on Security and Privacy in 2025 (Ho, Mirian, Savage, Voelker et al.). Over eight months, ten simulated phishing campaigns went to more than 19,500 employees, with randomly assigned control groups. Status: primary study, confirmed by the authors.
- Annual training: no significant relationship between having recently completed the annual module and the likelihood of clicking a phishing link.
- Embedded training, shown right after a click on a simulation: a statistically significant drop in failure rate, but of only about 2 points.
- Engagement: more than half of training sessions end within ten seconds, and fewer than 24% of employees formally complete the training.
- Exposure: over the study, 56% of employees (11,077 of 19,789) clicked at least once, trained or not. A well-chosen lure (a fake new vacation policy) drew more than 30% of clicks.
The authors cite an earlier study, fifteen months of embedded training across 14,000 employees, that also found no positive effect (reported). Their conclusion: in their current form, these programs are unlikely to reduce phishing risk significantly.
What the news just reminded us
In late October, four major Canadian law firms were compromised through fake IT help desk calls, which we covered in our 2 November recap. Status: confirmed by three of the firms, reported by The Globe and Mail for the fourth. These firms are among the best equipped in the country; it is fair to assume they run awareness programs. On 28 October, the Canadian Centre for Cyber Security published alert AL26-028 on this ongoing help desk voice phishing campaign. Status: confirmed.
Look at what the alert recommends. Strengthen verification for MFA resets, account recovery and new device enrolment. Deploy phishing-resistant MFA, such as FIDO2 security keys or device-bound passkeys. Require managed devices. Restrict external communications in Teams. Monitor for suspicious MFA registrations. The human part comes down to two instructions: independently verify any unexpected IT call, regardless of caller ID or urgency, and provide a clear channel for reporting. Almost everything else is process and controls.
We said it after Abbott: one phone call is enough when the reset process trusts a voice.
Three processes that do not ask anyone to be vigilant
1. A reset that does not trust a voice. The help desk never resets a password or MFA on the strength of a call alone. It calls the employee back on a number already on file, or requires in-person or video verification with ID, and notifies the manager. The technician does not have to judge whether the voice "sounds legitimate": the procedure decides.
2. MFA that refuses the fake site. A text message code, a push to approve or a six-digit code can be relayed in real time through a fake page. CISA has said it since 2022 in its "Implementing Phishing-Resistant MFA" fact sheet: FIDO/WebAuthn is the only widely available phishing-resistant authentication, and the agency strongly urges every organization to adopt it. Status: confirmed. With a FIDO2 key or a passkey, the employee can get the site wrong; the key does not.
3. Call-back for every transfer. Any request for payment, a change of bank details or an urgent wire is confirmed by calling back the number already known for the supplier or the executive, never the one in the email or the one that just called. Above a threshold, two people sign. With voice deepfakes, "I recognized the voice" is no longer proof.
Train differently, not less
Training still matters, provided it changes shape.
Short and frequent. Five minutes a month on the attack circulating this month beat forty minutes a year on a catalogue of generic threats.
Aimed at exposed roles. The help desk, accounts payable, executive assistants and administrators do not carry the same risk as everyone else. Their exercise should replay their real day: the hurried call, the request to change bank details, the reset on a Friday at 4:55 p.m.
Measured on reporting, not clicking. NIST, in SP 800-50 Rev. 1 (September 2024), now describes a life cycle learning program aimed at behaviour change, with metrics to improve it. The right indicator is not the click rate, which the UC San Diego study shows varies widely from one lure to the next. It is the time between the first report and the team's response.
Without shame. An employee who clicked and reports it within five minutes has just done you a favour. If they fear blame, they will stay silent, and silence is what costs.
And a 60-minute tabletop exercise tests leadership, not only employees: who kills the session, who calls the client, who decides.
The objections we take seriously
"Training is required by our insurer, our client or our framework." True, and you should keep it. But a compliance requirement is not a measure of effectiveness. Keep the module for the box; invest in processes for the risk.
"The study covers one hospital and email phishing." Also true. It does not prove all training is useless everywhere. But it is controlled, large-scale, and consistent with other work. The burden of proof has shifted: it is now up to the annual module to show it reduces risk.
"Processes cost more than training." Calling back a known number costs nothing. A FIDO2 key costs less than an hour of incident response. What costs a lot is the compromised account.
What do you think?
We know this position divides. Some awareness leads will read it as an attack; it is the opposite, a call to give them better tools. Others will say culture is built precisely through annual repetition. Tell us in the comments under our LinkedIn post: your last phishing incident, would one more training session have prevented it, or one less process built on trust?
Where FortaRisks helps
Forta Compliance maps your awareness, reset and authentication controls to 40+ frameworks, with dated evidence: the annual module stays, next to the processes that actually protect. Forta Actions turns gaps into assigned, tracked tasks, from hardening the help desk procedure to rolling out FIDO2 keys. To locate your most exposed processes on your own case, thirty minutes with an expert is enough, and our free tools give you a first snapshot.
Sources: Ho et al., Understanding the Efficacy of Phishing Training in Practice, IEEE Symposium on Security and Privacy (2025) · Canadian Centre for Cyber Security, alert AL26-028 (28 Oct. 2026) · CISA, Implementing Phishing-Resistant MFA (2022) · NIST, SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program (September 2024)