Security training decays without practice
Knowledge fades and habits do not form from a slide deck.
An annual module produces a completion percentage and very little behaviour change. What does work is practice close to the moment of decision: simulated exercises, prompts in context, and rehearsing the response rather than describing it. Measuring completion measures attendance.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- Security friction moves behaviour elsewhereSqueeze it here, it comes out there
- MFA fatigue weaponises repetitionAsk forty times
- Verify suspicious requests through a separate channelRing back on a line they never gave you
- People need a safe way to report mistakes quicklyThe shortest road back