For five years, we tried to explain why security training fails in a single sentence. We gave up on the sentence. And instead we wrote it as a formula.

(Engagement -> Awareness) x Culture = Instinctive Behaviour

It looks like a bit of consultancy theatre, admittedly, until you read it properly. Then it starts to sting a little because it shows you exactly which part of your programme the industry has been funding and which parts it’s been hoping would sort themselves out.

Let’s take it apart.

Engagement comes first, and it’s the part everyone skips

Engagement is not entertainment. It isn’t a gamified leaderboard bolted onto a module nobody really wanted to do. Engagement is the state of actually being present… leaning in, invested, sufficiently gripped that your brain bothers to encode what happens next.

And it has to come first. Engagement allows us to garner attention for long enough that the informational piece, awareness, can actually land. We can’t lead with the info.

In our experience, this is where a lot of programmes fall over before they’ve even got out the starting block… because the standard approach inverts it. It broadcasts information at people and hopes engagement shows up afterwards, like an unexpected guest. So you can get a room full of adults who are tired, rushed, half-listening, mentally writing an email, technically in attendance. Information arrives. Nothing encodes. The completion rate says 98%.

You cannot broadcast your way to awareness. You have to earn attention first, and earning it is a design problem, not a content problem.

Awareness is the middle term, not the goal

Here’s what makes the industry’s favourite metric so awkward. Awareness is real, it matters, and it is nowhere near sufficient.

We already know this because the evidence has been sitting in plain sight for years. 96% of people who clicked something risky knew it was risky. They weren’t unaware. They were busy. The most rigorous study ever done on annual training found it changed measurable behaviour by 1.7%, which is basically a polite way of saying it did absolutely nothing. And last year, the human element in breaches went up to 62%, after another 12 months of everyone diligently rolling out more awareness campaigns.

If awareness were the answer, those numbers would move. They don’t move. So awareness is a waypoint, not a destination.

Culture is the multiplier for a reason

This is the term that ruins the maths for a lot of organisations, and it’s multiplied rather than added quite deliberately.

Add a weak term and you lose a bit. Multiply by a weak term and you lose nearly everything. Multiply by zero and it doesn’t matter what’s in the bracket at all.

The most engaged, most genuinely aware employee in the building will still say nothing if the environment punishes speaking up. If reporting a mistake means a meeting with your manager and a note on your file, people will make a rational calculation and stay quiet. And your incident response, which depends largely on someone putting their hand up early, now depends on someone being brave instead.

That’s not a training gap. And you can’t fix it with content. It’s a question of whether your organisation is safe to be human in.

What you actually get if all three hold

Instinctive behaviour. The only thing that protects anyone when it counts.

The pause before the click, before the reason for pausing is conscious. The second look at the invoice that’s slightly wrong in a way nobody could articulate. The phone call to check, made before acting rather than after apologising.

Instinct is not knowledge retrieved quickly. It’s a rehearsed response that fires without waiting for the reasoning to catch up. And rehearsed is the operative word… it’s the only route in. Aviation knows this. Surgery knows this. The military built its entire culture on it. Every field where getting it wrong costs something real stopped telling people things a long time ago, and started making them do the thing… repeatedly… under conditions realistic enough to raise a pulse.

Security is the outlier. The one high-stakes discipline still treating an annual presentation as preparation.

Why this explains the green dashboard problem

A lot of programmes pour their entire budget into the middle term, awareness, and then stare at a healthy-looking dashboard wondering why nothing has changed on the ground.

Now you can see why. They’re optimising one variable in an equation with three, and the two they’re ignoring are the ones with the leverage. Engagement gates everything downstream of it. Culture can zero the lot.

Which also means the honest diagnostic question isn’t “are we doing enough training?”. It’s “which of our three terms is the weakest?” Because they need different responses. Weak engagement is a design problem. Weak culture is a leadership problem. And no amount of slide decks on the signs of phishing fixes either of those two things.

Where to Start

IF you want to know which term is failing in your organisation, we built a free three-minute check that will tell you: The Behaviour Formula Check.

And if you want a longer version of this argument, with the evidence attached, it’s the whole of our book, May I Have Your Attention Please?

This formula is the thinking underneath everything we build. It’s why human risk management training in our hands looks like rehearsal rather than a curriculum… and why the products run on a cadence instead of once a year.