Most companies still treat phishing awareness as a once-a-year event: a 45-minute video, a quiz and a completion certificate for the auditor. The research says that model doesn't work. A study of more than 19,500 employees found no measurable link between yearly training and the likelihood of falling for phishing attacks, and attackers now write flawless lures with AI and clone executives' voices. This guide is for the CIO, CISO or IT director at a 50–500 person regulated company who needs a program that changes behavior rather than one that checks a box. It covers why once-a-year training falls short, what to measure instead, how to run phishing simulations that work, what training has to cover in 2026, and which numbers belong in front of your board.
What is phishing awareness training?
Phishing awareness training teaches employees to recognize and report phishing email, text and voice lures. A strong security awareness program combines three forms of training: short lessons on current tactics, phishing simulation that sends realistic but harmless test messages, and fast feedback when someone spots or misses a lure. The goal is a habit, not a quiz score: see something odd, report it, move on.
The difference between a phishing awareness program and a compliance exercise is frequency and context. One training session a year teaches people about threats in a classroom setting, months away from the moment of risk. A phishing simulation puts the lesson in their own inbox, during a normal workday, which is where real phishing attempts arrive.
Good phishing training also measures itself. Simulation results show which teams, roles and lure types carry the most phishing susceptibility, so you can tailor training to the people and scenarios that need it rather than repeating the same training materials for everyone.
Why click-rate training plateaus
Click rate is the number most training programs report, and it's the first to stop improving. Early campaigns catch the easy wins; after a year, phishing simulation click rates settle at a low number and stay there. Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches, about the same as the year before, despite years of training spend. Phishing remains one of the most common ways attackers get in, at 16% of breaches.
The research explains why. A UC San Diego Health study of more than 19,500 employees across 10 campaigns found that annual training had no significant relationship with whether employees fell for phishing, and that embedded training, the lesson shown when an employee clicks a simulated phishing link, cut clicking by only about 2%. Three-quarters of users spent a minute or less on that lesson, and a third closed it immediately.
A broader Cybersecurity Dive review of why security awareness training doesn’t work looked at more than a dozen studies and reached the same conclusion: common cybersecurity training methods do not significantly reduce phishing susceptibility, and gains often fade within months. That is why training programs fail when click rate is the goal. The number can't reach zero, and it doesn't tell you whether the organization is getting safer.
What phishing resilience measures: report rate, time to report, repeat clickers
Resilience asks a better question: when a lure gets through, how fast does the organization notice? Report rate measures the share of employees who flag a message using the phishing report button. Unlike click rate, it can keep climbing, and every report is a sensor your security team didn't have to buy. Effective security awareness makes it easy and rewarding to report suspicious emails.
Time to report matters even more. If the first report arrives four minutes after a phishing email lands, your team can pull it from every inbox before most people open it. If it arrives two hours later, the damage is done. Track the median time from delivery to first report for every campaign and for every live phishing attack.
Repeat clickers are the third measure. A small group usually accounts for a large share of clicks across phishing campaigns. They need different help: targeted training, coaching, stronger technical controls on their accounts, or a review of whether their role exposes them to more lures than average. Treating them as a group to support, not a list to punish, is what separates a mature program from a blame exercise.
How to run phishing simulations that change behaviour
Start with a baseline phishing test before any training, so you know where you stand. Then build a calendar of simulations that vary the lure: credential pages, fake invoices, delivery notices, HR updates, shared-document links and QR codes. Mix traditional phishing templates with sophisticated phishing that mirrors what your sector actually sees.
Make reporting the easiest action in the inbox, and reward it. Researchers quoted in that review suggest emphasizing reminders and reporting over testing and tricking, and warn that shaming people doesn't work. When someone clicks, short just-in-time training can explain the cues they missed, but don't expect it to carry the program: the evidence shows embedded training on its own has a small effect.
Close the loop with your security operations team. Every reported simulated phishing attack should flow through the same queue as a real report, so your response process is exercised alongside your people. Use simulation results to refine the next campaign, and update training content when attacker tactics change.
How does continuous security awareness replace annual security training?
This approach replaces the yearly course with short, regular touchpoints: a monthly phishing simulation, a two- to three-minute lesson on one current tactic, and timely nudges when a new lure is circulating. Continuous training in small doses keeps people alert between tests, and research on nudges suggests regular reminders drive more of the effect than the lessons themselves.
Annual training may still be required for compliance, and you can keep a yearly training module for that record. But annual training cannot build a habit on its own, which is why awareness programs should be built around frequency rather than a single annual event. How training is delivered matters as much as what it says.
Effective training is also specific. A finance clerk needs to spot invoice fraud and voice-cloned approval requests; an IT administrator needs to spot fake MFA prompts. Tailored, frequent lessons respect people's time, and training builds habits when it's tied to something they just saw in their own inbox.
AI-written phishing and voice deepfakes: what training has to cover now
The old advice to look for spelling mistakes is obsolete. AI writes clean, well-targeted messages in any tone, and Verizon found that phishing makes up the largest share, 44%, of the AI-assisted initial access it tracked. That makes AI-generated spear phishing, once expensive to produce, cheap enough to aim at mid-level staff in finance, HR and IT.
Voice is the newer front. The FBI has warned that criminals use AI-generated voice messages to impersonate senior officials and build trust before asking for access or money. The same phishing and social engineering attacks target companies: a call that sounds exactly like the CFO, approving an urgent wire or asking an assistant to share sensitive data. Training has to cover voice and text lures, not just email.
The behavior to teach is verification, not detection. Employees won't reliably hear a deepfake, but they can learn that any request involving money, credentials or data gets confirmed through a second, known channel, such as calling back on a number from the directory. Build that rule into policy, then test it with voice and text simulations.
The technical controls that catch what people miss
People are one layer of defense, not the whole defense. Training improves recognition, but phishing detection has to start before a message reaches anyone. Email authentication (SPF, DKIM and DMARC), link and attachment sandboxing, and blocking newly registered domains stop most lures upstream. Our comprehensive guide to phishing protection covers these controls in depth.
The most important control sits after the click. CISA recommends phishing-resistant multi-factor authentication, such as FIDO2 security keys or passkeys, because they can't be relayed through a fake login page the way codes and push approvals can. Our analysis of MFA and data breaches in healthcare shows how much exposure that single control removes.
Add endpoint detection and fast password resets whenever someone clicks a phishing message in real life. Because stolen credentials often surface on criminal markets, dark web monitoring can also tell you when a click turned into a leak.
Which regulations require phishing awareness training?
Several frameworks name it directly. PCI DSS v4.0.1 requires security awareness training that covers phishing and related social engineering for anyone with access to cardholder data. The HIPAA Security Rule requires a security awareness program for the workforce of covered entities and business associates. For defense suppliers, the awareness and training family in NIST SP 800-171 is part of CMMC, and New York's cybersecurity regulation requires periodic training that includes social engineering.
These training requirements set a floor, not a ceiling. Treating awareness as a compliance checkbox, with one annual course and a completion report, satisfies the letter of most rules while leaving the organization exposed. Auditors increasingly expect a program with schedules, simulation records and evidence of follow-up.
The practical approach is to let compliance define the minimum and let risk define the program. A traditional cybersecurity awareness training course delivered once a year will pass an audit; a continuous phishing awareness training program with monthly simulations and reporting data will pass the audit and reduce phishing risk at the same time.
Metrics to report to the board
Boards don't need click rates by department. They need to know whether risk from people is going down. Report four numbers each quarter: report rate, median time to first report, the trend in repeat clickers, and how many real phishing attempts employees reported that your tools missed. That last figure is the most persuasive, because it shows people acting as sensors against live threats.
Tie the numbers to cost. IBM's Cost of a Data Breach report puts the global average at $4.99 million in its 2026 edition and calls out AI-driven attacks and deepfake impersonation as growing factors. A program that reduces successful phishing attacks, even by catching one early, is worth far more than its budget.
Be honest about what the data shows. Few studies show that training reduced click rates for long; what you can show is faster reporting, fewer repeat clickers and earlier detection. Lower phishing click rates are welcome, but reporting speed is the number that limits damage.
In-house program or managed service?
Running it in-house works if someone owns it. A program needs a training platform, a monthly content calendar, lure design that tracks current threats, and someone to analyze results and coach repeat clickers. Many mid-market teams buy the platform, run out of hours, and let campaigns slip to quarterly while the content goes stale.
A managed service fills that gap. A provider designs and sends the campaigns, refreshes lures as attacker tactics change, runs voice and text tests, and delivers board-ready reporting. You keep ownership of policy and the reporting process; they keep the cadence. Our guide to the first 90 days of fractional CISO services shows how awareness work fits into a broader security program when there's no full-time CISO.
Either way, decide based on whether the program will actually run monthly. Building a security awareness habit takes a schedule someone keeps, and modern security awareness depends on that consistency more than on any single lesson.
Frequently asked questions
Why does phishing awareness training fail?
Most programs rely on a once-a-year course and measure click rate. A UC San Diego Health study of more than 19,500 employees found no significant link between annual training and falling for phishing, and embedded training cut clicking by only about 2%.
What should you measure instead of click rate?
Report rate, median time from delivery to first report, and the trend in repeat clickers. These show how quickly the organization notices a lure, which is what limits damage.
How often should you run phishing simulations?
Monthly works for most organizations, paired with two- to three-minute lessons on one current tactic and timely nudges when a new lure is circulating. Vary the lures, including QR codes, voice and text.
How do you train employees against AI-written phishing and voice deepfakes?
Teach verification rather than detection. Any request involving money, credentials or data should be confirmed through a second, known channel, such as calling back on a number from the directory, and that rule should be tested with voice and text simulations.
Which regulations require phishing awareness training?
PCI DSS v4.0.1 requires awareness training covering phishing and social engineering, the HIPAA Security Rule requires a security awareness program, NIST SP 800-171 includes awareness and training for CMMC, and New York's cybersecurity regulation requires periodic training that includes social engineering.
Build a program your people (and your board) will notice
VisioneerIT's Security Training Essential service runs monthly phishing simulation, short lessons and board reporting for regulated mid-market companies. For executives at higher risk of voice impersonation, our executive protection team adds targeted testing and exposure reduction, and our cybersecurity consulting group folds it all into your wider security strategy. Talk to our team about a baseline campaign.
Key Things to Remember
- Large studies show no measurable effect from yearly training on phishing clicks, and embedded training alone helps only slightly.
- Click rates plateau; report rate, time to first report and repeat clickers show real resilience.
- Make reporting easy and rewarded, use regular nudges, and never shame people who click.
- Continuous, short, tailored lessons and monthly phishing simulation beat a once-a-year course.
- AI makes lures cleaner and voices cloneable, so teach verification through a second, known channel.
- Phishing-resistant MFA and email authentication catch what people miss.
- Let compliance set the minimum and risk set the program, then report four people-risk numbers to the board.
