Research Series

The Evidence Base. No Fluff.

Why immersive learning works, why passive training doesn't, what a breach actually costs, and what the data says about annual compliance modules. Four research pages. All sourced. None of it comfortable reading if you're still running the same programme you were five years ago.

The Central Finding

Annual cyber security training had no measurable impact on phishing susceptibility. The average different between trained and untrained groups?

1.7%

Ho et al. (2025), UC San Diego & University of Chicago. Randomised controlled study, n=19,500 employees.

60%

of confirmed data breaches involve human behaviour - not technical failures.

Verizon DBIR 2025

$4.4M

average global cost of a data breach. In the US: $10.22M.

IBM Cost of a Data Breach 2025

56%

better test scores with active learning vs passive lectures. Same content, different format.

Deslauriers et al., PNAS 2019

86%

reduction in phishing susceptibility with continuous immersive training over 12 months.

KnowBe4 2025, n=14.5M users

The Research Series

Four Papers. One Argument.

The case for immersive cyber security training isn't a hunch or a sales pitch. It's built from neuroscience, cognitive psychology, breach cost data, and cyber security-specific outcome research. These four pages make the argument from every single angle.

01 ⋅ The Neuroscience

The brain doesn't learn through slides

Why the brain encodes experiences differently from information. Emotional memory, dopamine reward loops, flow states, and what they mean for how you design training.

56%

Better Retention

1.5×

More likely to fail passively

40%

longer task persistence

02 ⋅ Retention

Why everything you teach will be forgotten

The Ebbinghaus Forgetting Curve. What retrieval practice actually does to memory. Why the Learning Pyramid percentages are made up - and what the real data says instead.

56%

forgotten within 1 hour

13%

Lost with retrieval practice

90%

gone within a week passively

03 ⋅ Business Case

The maths is simple. The industry ignores it.

What a breach actually costs. Why 95% of risky actions are taken knowingly. The financial case for investing in training that works instead of training that's cheap to report on.

$4.4m

Average breach cost

96%

knew the risk

38%

breach cost reduction

04 ⋅ Cyber-Specific

Your training isn't working. The numbers say so.

Annual compliance modules, measured against a randomised controlled study of 19,500 employees. What continuous simulation-based training does instead. The 8% problem.

1.7%

impact of annual training

60%

breaches - human element

86%

phishing reduction possible

Full White Paper

May I have Your Attention, Please?

The full paper underpinning the Behaviour Cycle - twelve chapters covering the neuroscience of engagement, narrative transportation, the psychology of fun, and how behaviour actually becomes instinct. Available as a downloadable PDF.

Coming soon

The Framework

See how the research shapes the design

The Behaviour Cycle turns this evidence into a working design system - three levers that produce one outcome the industry has been chasing for twenty years.

explore the behaviour cycle

Find out where your programme is losing people

The Behaviour Cycle Check takes three minutes. It tells you exactly what stage you're skipping - and what to do about it.

Take the Free Check