The Engagement Paradox

Ask any security leader what they actually want from training, and the answer is some version of the same thing: people who do the right thing in the moment that matters. Spot the dodgy email. Question the unexpected call. Report the thing that feels off, even when they’re busy and it would be easier to let it slide.

In other words, they want instinct.

Then look at what they buy. Annual modules engineered for rapid completion. Quizzes built to be passed. Platforms chosen because they produce a clean audit trail. Formats optimised for efficiency, consistency and legal defensibility.

In other words, they fund awareness.

That gap, between the behaviour organisations say they want and the learning they actually invest in, is the engagement paradox. And until you can see it clearly, you’ll keep buying the same thing and feeling surprised by the same result.

Knowing Is Not Doing

The paradox survives on a comfortable assumption: that if people know what to do, they’ll do it. Close the knowledge gap and the behaviour follows.

It doesn’t. Proofpoint surveyed 7,500 working adults and found 71% had taken a risky action at work. Of those, 96% knew it was risky when they did it.

Read that again. The awareness was there. The training had been completed. The knowledge existed. It just didn’t show up in the moment, because the moment was rushed, social, pressured and nothing like the calm conditions the training was delivered in.

An employee can pass a phishing quiz at 9am and hand their credentials to a convincing stranger by 3pm. They have the knowledge. What they’re missing is activation: the thing that turns “I know this” into “I did this” when it counts.

Why the Paradox Persists

If awareness-led training doesn’t change behaviour, why is it still everywhere?

Because it’s measurable, and measurable feels safe. Completion rates are easy to capture. Quiz scores are easy to report. A board pack full of green ticks is easy to defend. The system was never designed to change behaviour. It was designed to prove that something was done. And in the gap between those two goals, the risk quietly lives.

Nobody sets out to build a programme that looks good and changes nothing. The intent is real and the budget is real. But when the metric becomes completion rather than capability, the whole machine optimises for the wrong thing. People learn to finish the module. The training hits its own target perfectly, while the actual goal, behaviour under pressure, goes entirely unmeasured.

Closing the Gap

You cannot change behaviour by telling people to behave differently. You can only change it by reshaping the moment itself.

That means building the conditions real decisions are made in: pressure, stakes, consequence, ambiguity, a clock. It means designing for recognition rather than recall, and measuring what changes rather than what was delivered. It means treating engagement not as a nice-to-have that makes the training more pleasant, but as the mechanism that gets anything to stick at all.

The organisations pulling ahead have stopped asking whether their people are aware of the risks. They’ve started asking whether their people are ready for them. It sounds like a small shift. It changes everything about what you design, what you measure, and what you report.

The question was never whether your people know. They know. The question is what happens when knowing isn’t enough.