The industry renamed it instead of fixing it
The security industry has spent three years agreeing with us. The analysts retired the name. The vendors rewrote their websites. Every one of them now says the same thing we've been saying since we started: knowing about security doesn't make anybody behave differently.
Then they carried on selling the same thing.
Vendors who moved from security awareness training to human risk management between June 2022 and August 2025: KnowBe4, Proofpoint, Mimecast, SoSafe, Hoxhunt, CultureAI and Living Security. The label moved. This page is about what sits underneath it.
Vendor announcements and product pages, verified August 2026.The year by which Gartner expects "all widely adopted cybersecurity control frameworks" to measure behaviour change rather than compliance-based training. Their words, not ours. Four years from now, on their own forecast, the thing most organisations currently buy stops counting as evidence of anything.
Gartner, published cybersecurity insights.Of employees now use AI on corporate devices, up from 15% a year earlier. 67% are doing it through non-corporate accounts. Whatever your annual module said about AI last October, it was written for a workforce three times smaller than the one you have now.
Verizon (2026). Data Breach Investigations Report.Four findings. One concession.
Four Years · The Name Changed First
In 2024 Forrester formally retired the name “security awareness and training”, because it “has us focusing on the methods by which we train people, rather than the outcomes.” Gartner is blunter: “Legacy approaches delivering curriculum-based, awareness-centric programs are no longer effective.”
Then the market followed. Between June 2022 and August 2025, seven vendors rebuilt themselves around the same four words: human risk management.
Even Mimecast’s own State of Human Risk 2026 says it: “organizations cannot train their way out of insider risk.”
7% to 15% · And Now It Replicates
A randomised trial of 19,500 employees found annual training changed phishing susceptibility by 1.7%. Six weeks later, a Purdue team reproduced it across another 12,511 people and found “no significant main effects on click rates... or reporting rates.”
What did predict clicking was how good the fake was: 7.0% fell for the most obvious, 15.0% for the most convincing. The attack mattered. The training didn’t.
60 Seconds · Practice, Made Painless
Some vendors now say practice instead of training. Hoxhunt: “Behavior change happens with engagement with frequently repeated practice.” They’re right.
But by their own figure a simulation takes 30 to 60 seconds, by email, alone at your desk, with nothing at stake. You cannot rehearse a decision that costs nothing.
0.50 · What Actually Changes Behaviour
Medicine has tested this for decades. One review pulled together 609 studies covering more than 35,000 doctors, nurses and students, comparing people who trained on simulations with people who had no such training.
Practice made a big difference to what they knew, a clear difference to what they actually did on the job, and a smaller but real difference to how their patients got on. What made it work was talking it through afterwards and doing it again.
The Problem Was Never The Content
Every organisation we walk into has content. Modules, posters, intranet pages, a policy nobody's opened since induction. The library is rarely the gap.
What almost nobody has is a single occasion in the calendar year where their people have to make a security decision, under time pressure, in front of colleagues, and then find out what it cost them.
That is the difference between knowing and doing. Your people already know not to click the link. They knew last year too, right up until the invoice arrived at 4pm on a Friday looking almost right.
The Word Survived. The Method Didn't.
We’re not the only people who talk about practice. Living Security sell CyberEscape Online; Hoxhunt built their platform on repeated practice. The industry took the word and dropped most of what the evidence said made practice work.
What changed clinician behaviour was team-based, facilitated, repeated to a standard and debriefed, with consequences that felt real. What’s sold as practice now is solo, under a minute and consequence-free.
Pressure, other people, and a debrief that names what just happened are the parts that carried the effect. So those are the parts we build.
Research sources (9)
- Department for Science, Innovation and Technology (2026). Cyber Security Breaches Survey 2025/26. UK Government official statistics, published 30 April 2026. 2,112 UK businesses and 1,085 charities.
- Rozema, A.T. & Davis, J.C. (2025). Anti-Phishing Training (Still) Does Not Work: A Large-Scale Reproduction of Phishing Training Inefficacy Grounded in the NIST Phish Scale. arXiv:2506.19899 (v3, October 2025). N=12,511.
- Ho, G. et al. (2025). Understanding the Efficacy of Phishing Training in Practice. University of California San Diego / University of Chicago. N=19,500.
- Yin, D., Mullarkey, M.T., de Vreede, G-J. & Limayem, M. (2026). Learning by Phishing via Post-Simulation Feedback: From Embedded to Non-Embedded Training. MIS Quarterly, 50(2), 767-784. Published 31 May 2026.
- Cook, D.A. et al. (2011). Technology-Enhanced Simulation for Health Professions Education: A Systematic Review and Meta-Analysis. JAMA, 306(9), 978-988. 609 studies, 35,226 trainees.
- McGaghie, W.C., Issenberg, S.B., Barsuk, J.H. & Wayne, D.B. (2014). A Critical Review of Simulation-Based Mastery Learning with Translational Outcomes. Medical Education, 48, 375-385.
- Verizon (2026). 2026 Data Breach Investigations Report. Published 19 May 2026.
- IBM Security / Ponemon Institute (2026). Cost of a Data Breach Report 2026. Published 29 July 2026. 602 organisations.
- Analyst positions cited from Forrester's own blog announcing the retirement of the security awareness and training category, and from Gartner's published cybersecurity insights. Both firms are commercial analyst businesses with paying relationships across this market, including with several of the vendors named on this page.
Rehearsal, not another module.
Pressure, other people and a debrief that names what just happened. That is what practice looks like when it works.