Why security awareness training doesn’t work — and how to fix it – Cybersecurity Dive

Report on the Inefficacy of Cybersecurity Awareness Training and its Implications for Sustainable Development Goals

Executive Summary

An analysis of over a dozen academic studies indicates that conventional cybersecurity awareness training programs are largely ineffective at preventing security breaches. These findings have significant implications for the achievement of several Sustainable Development Goals (SDGs) that depend on secure and resilient digital infrastructure. Current training methods, including annual assessments and remedial lessons, fail to produce sustained behavioral change, thereby undermining efforts to build strong institutions (SDG 16), foster innovation (SDG 9), and ensure economic stability (SDG 8).

Analysis of Current Training Methodologies and Their Failure to Support Global Goals

Ineffectiveness of Periodic and Embedded Training

Research demonstrates a critical failure in standard industry practices for cybersecurity education. These shortcomings directly threaten the stability of the digital systems essential for sustainable development.

• A study by researchers at the University of Chicago and the University of California, San Diego found no evidence that annual security awareness training correlates with a reduction in phishing failures.
• Remedial or “embedded” training, provided only after an employee fails a phishing test, is inefficient as it fails to reach all susceptible users.
• Research from ETH Zurich indicates that embedded training can be counterproductive, making employees overconfident and more susceptible to future attacks. This undermines the resilience required for SDG 9 (Industry, Innovation, and Infrastructure).

Failure to Protect Vulnerable Individuals and Institutions

Mandatory training programs have proven ineffective for the employees most at risk, leaving critical institutions vulnerable. This failure to secure the human element of cybersecurity poses a direct threat to SDG 16 (Peace, Justice, and Strong Institutions), which relies on the integrity and reliability of public and private organizations.

1. An ETH Zurich study found that the threat of mandatory training provided no additional benefits for the most susceptible participants.
2. A 2019 Harvard University study concluded that mandatory training for repeat offenders did not have a substantial impact on their click rates in phishing simulations.
3. The positive effects of training, when observed, are fleeting. A 2020 study showed that improvements in identifying phishing emails disappeared after six months, indicating a failure to create the sustained behavioral change necessary for long-term institutional resilience.

The Knowledge-Behavior Gap: A Systemic Risk to Sustainable Development

Inability to Convert Knowledge into Secure Practices

A primary obstacle identified across multiple studies is the gap between knowledge acquisition and behavioral change. This gap reflects a systemic failure in educational approaches that has broad consequences for development goals dependent on a secure digital society.

• A 2024 meta-analysis from Leiden University concluded that while training increases knowledge and positive attitudes, changes in actual security behavior are minimal. This disconnect highlights a challenge related to the principles of SDG 4 (Quality Education), which aims for effective learning outcomes.
• Researchers note that human habits and preconceived notions about risk have more inertia than training materials.
• Studies suggest that simple “nudges” and reminders about security are more effective drivers of behavior than the actual content of training modules.

Implications for Critical Infrastructure and Economic Growth

The failure of current training paradigms to secure organizations exposes the foundational infrastructure of modern economies to significant risk. This vulnerability directly impedes progress toward key SDGs.

• SDG 8 (Decent Work and Economic Growth): Ineffective training contributes to successful cyberattacks, which cause significant financial losses, disrupt business operations, and threaten economic stability.
• SDG 9 (Industry, Innovation, and Infrastructure): The goal of building resilient infrastructure is compromised when the human operators of that infrastructure remain a primary vulnerability.
• SDG 11 (Sustainable Cities and Communities): The digital systems managing essential public services in urban areas remain at risk, threatening the safety and sustainability of communities.

Recommendations for Aligning Cybersecurity Education with Sustainable Development

Adopting a Behavior-Centric Framework

To effectively support global sustainability, cybersecurity training must evolve from a knowledge-transfer model to one focused on behavioral science and habit formation. Researchers recommend a strategic shift in approach.

1. Avoid counterproductive tactics such as scaring or shaming users.
2. Provide educational content that is targeted, actionable, and supported by continuous feedback to help form secure habits.
3. Focus on shaping employee attitudes and motivations regarding security, as these are precursors to behavior.
4. Design interventions that address the root causes of why an individual falls for a phishing email, rather than applying a one-size-fits-all solution.

Conclusion: Strengthening Institutional Resilience for SDG Achievement

The current scholarly consensus indicates that commonly deployed cybersecurity training offers minimal protective benefits. This represents a critical failure to secure the digital ecosystem upon which progress toward the Sustainable Development Goals depends. Achieving a secure and resilient digital future requires a fundamental redesign of security education, moving toward evidence-based, behavioral approaches that can create lasting change and fortify the institutions central to SDG 16 and the infrastructure vital to SDG 9.

Analysis of Sustainable Development Goals in the Article

1. Which SDGs are addressed or connected to the issues highlighted in the article?

• SDG 4: Quality Education

  The article’s central theme is the failure of cybersecurity awareness training, which is a form of specialized education and skill development. It critiques current educational methods for not leading to sustained behavioral change, connecting directly to the goal of providing effective, relevant education and lifelong learning opportunities.

• SDG 8: Decent Work and Economic Growth

  The ineffectiveness of cybersecurity training leaves private businesses, government agencies, and non-profits vulnerable to cyberattacks. Such breaches can disrupt operations, cause financial loss, and undermine economic productivity, thereby affecting economic growth and the stability of workplaces.

• SDG 9: Industry, Innovation, and Infrastructure

  The article discusses the vulnerability of the digital infrastructure that modern industries rely on. Ineffective training makes this infrastructure less resilient. Furthermore, the article is a review of scientific research, highlighting flaws and calling for innovation in how cybersecurity education is designed and delivered to better protect industrial and technological systems.

• SDG 16: Peace, Justice, and Strong Institutions

  The article explicitly mentions that “Government agencies” use these ineffective training programs. The vulnerability of public institutions to cyber threats like phishing compromises their effectiveness, accountability, and the security of the data they hold, which is crucial for building strong and trustworthy institutions.

2. What specific targets under those SDGs can be identified based on the article’s content?

• Under SDG 4: Quality Education
  • Target 4.4: “By 2030, substantially increase the number of youth and adults who have relevant skills, including technical and vocational skills, for employment, decent jobs and entrepreneurship.” The article directly addresses this by demonstrating that current cybersecurity training fails to impart relevant and effective skills. It notes that training “is not providing meaningful new knowledge or education to users” and that “changes in behaviour can only be observed minimally,” indicating a major gap in skill acquisition for the modern workforce.
• Under SDG 8: Decent Work and Economic Growth
  • Target 8.2: “Achieve higher levels of economic productivity through diversification, technological upgrading and innovation…” Cybersecurity is fundamental to protecting technological upgrades and maintaining economic productivity. The article’s conclusion that organizations “remain vulnerable to breaches that have skyrocketed” implies a direct threat to productivity and economic stability, which effective training is supposed to mitigate.
• Under SDG 9: Industry, Innovation, and Infrastructure
  • Target 9.1: “Develop quality, reliable, sustainable and resilient infrastructure… to support economic development and human well-being.” Digital systems are a core component of modern infrastructure. The article highlights the lack of resilience in this infrastructure due to the human element, stating that current training does “not make employees more resilient to phishing.”
  • Target 9.5: “Enhance scientific research, upgrade the technological capabilities of industrial sectors… and encourage innovation.” The article is a meta-analysis of scientific research, critiquing “methodological flaws in earlier research” and implicitly calling for innovation. Recommendations to focus on “behavioral science” and find “methods of training that are suitable for each cybersecurity behaviour” point directly to the need for enhanced research and innovation in this field.
• Under SDG 16: Peace, Justice, and Strong Institutions
  • Target 16.6: “Develop effective, accountable and transparent institutions at all levels.” The article’s mention of “Government agencies” being subject to flawed training indicates a risk to their institutional effectiveness. A successful phishing attack on a government agency can compromise its operations, data, and public trust, undermining its accountability and strength.

3. Are there any indicators mentioned or implied in the article that can be used to measure progress towards the identified targets?

• For Target 4.4 (Relevant Skills)
  • Implied Indicator: Phishing failure/click rates. The article consistently uses this metric to measure the effectiveness of training. The Harvard study, for example, found that mandatory training “did not have a substantial impact on click rates.” A reduction in these rates would indicate progress.
  • Implied Indicator: Sustained behavioral change over time. The article highlights that training effects are not long-lasting, noting that by the “six-month mark, the improvement had disappeared.” An indicator would be the measurement of phishing resilience at set intervals (e.g., 4, 6, 12 months) post-training to track sustained skills.
• For Target 9.1 (Resilient Infrastructure)
  • Implied Indicator: Rate of successful phishing attacks against organizations. The article’s premise is that ineffective training leads to successful attacks. The number of breaches resulting from employees falling for phishing scams serves as a direct measure of the digital infrastructure’s resilience to human-targeted threats.
• For Target 9.5 (Research and Innovation)
  • Implied Indicator: Number and quality of studies on behavioral science-based cybersecurity training. The article critiques the methodology of past research (“contrived experimental conditions,” “small sample size”) and calls for a new approach based on understanding “the root cause of why someone falls for a phishing email.” Progress could be measured by the shift in research focus towards more robust, behavior-centric models as advocated by experts like Arun Vishwanath.
• For Target 16.6 (Effective Institutions)
  • Implied Indicator: Number of security incidents in government agencies caused by phishing. While not providing specific numbers, the article identifies government agencies as a key group at risk. Tracking the frequency and impact of phishing-related breaches within these institutions would serve as an indicator of their operational effectiveness and security posture.

4. Table of SDGs, Targets, and Indicators

Source: cybersecuritydive.com