Most security awareness training measures the wrong thing. It tracks whether people completed a module or passed a quiz, facts they can recite. But breaches are not caused by a lack of facts. They are caused by a decision made under pressure, in a hurry, on a normal Tuesday. Behaviour-led awareness trains those decisions.
The problem with fact-based training
Traditional awareness training assumes that if people know the right answer, they will do the right thing. Everyone "knows" not to click suspicious links. Yet phishing still works, because knowing and doing are different systems in the brain. Under time pressure, with a plausible story and an authority figure applying urgency, people act on instinct, not on last quarter's e-learning.
The result is a compliance tick-box that satisfies an auditor and changes almost nothing about how people behave when it matters.
What "behaviour-led" means
Behaviour-led awareness starts from a simple shift: the goal is not knowledge, it is a changed decision at the moment of risk. That changes what you train, and how you measure it.
- Train the moment, not the topic. Instead of a module on "phishing", rehearse the specific decision, a supplier emails new bank details before an invoice is due; what do you actually do?
- Use realistic pressure. Decisions made calmly in a classroom do not predict decisions made under a deadline. Effective training recreates the pressure.
- Make it safe to be wrong. People only learn from a mistake they are allowed to make without punishment. Fear produces performance, not learning.
The behavioural science underneath
Security decisions are shaped by the same cognitive shortcuts attackers exploit deliberately: authority (a message that appears to come from the boss), urgency (a deadline that removes time to think), social proof (everyone else seems to have complied), and commitment (once you have started a task, you tend to finish it). Naming these biases and rehearsing against them is far more durable than a list of "red flags".
How to build a behaviour-led programme
1. Identify the decisions that matter
List the handful of moments where a wrong human decision actually causes harm in your organisation: approving payments, changing supplier details, granting access, handling data requests, responding to alerts. Train those, not a generic curriculum.
2. Rehearse under realistic conditions
Move from watching to doing. Facilitated exercises, simulations, and decision drills put people in the moment and let them practise the response until it becomes reflex.
3. Measure behaviour, not completion
Replace "percentage of staff who completed training" with measures that reflect behaviour: how quickly a suspicious payment request is challenged, how often people verify out-of-band, how fast an incident is escalated. These are the numbers a board should care about.
4. Make the safe action the easy action
Behaviour change is not only about people; it is about the path of least resistance. A call-back verification step for payment changes, a clear and blameless way to report a mistake, and an approval workflow all make the secure choice the default. Culture and process do half the work.
Why this matters for leadership
Behaviour-led awareness is also a better story for the board. "We trained 300 decisions and improved challenge rates on suspicious payments" is a meaningful outcome. "94% completed the module" is not. Framing awareness around decisions connects security to the business risks leaders already understand: fraud, downtime and reputation.
The six decisions worth training
Most harm in most organisations flows through a small number of repeated human decisions. Train these properly and you have covered the majority of realistic risk.
Approving a payment or changing bank details. The single most expensive decision most staff will ever make. The behaviour you want is a verification step through a separately-sourced channel, never a number or address taken from the email itself.
Acting on an urgent request from a senior person. Authority plus time pressure is the standard structure of social engineering. The behaviour you want is a culture where checking is normal and nobody is punished for it.
Clicking or entering credentials on a login page. Not "spotting phishing" in the abstract, but the specific habit of checking where a credential is about to be typed, and reporting rather than quietly closing the tab.
Granting access or resetting an account. Help desks are targeted precisely because their job is to be helpful. The behaviour you want is a consistent identity-verification step that does not bend for seniority or urgency.
Handling data, especially moving it somewhere convenient. Personal data forwarded to a personal address to work on at home is a breach with good intentions behind it.
Reporting something that looks wrong, including your own mistake. This is the decision that determines whether an incident is contained in twenty minutes or discovered in three weeks. It is a cultural outcome, not a knowledge one.
What to measure instead of completion
If you replace one metric, replace completion rate. Useful measures include:
- Report rate, and specifically the proportion of genuinely suspicious messages reported rather than deleted.
- Time to first report after a simulated or real campaign begins. Minutes matter more than percentages.
- Challenge rate on payment and access changes: how often a verification step actually occurred.
- Self-reporting of mistakes, which is the clearest single indicator of psychological safety.
- Repeat-decision improvement: whether the same team handles the same class of decision better than it did six months ago.
Two cautions. Click rate on phishing simulations is a weak measure on its own and a harmful one if used punitively: driving clicks down while suppressing reporting makes you less safe, not more. And any metric that people know they are scored on personally will be gamed, so report at team level.
Making it safe to be wrong
Every behaviour above depends on people telling you things. That makes psychological safety a security control, not a wellbeing nicety.
In practice this means naming the rule out loud: reporting a mistake quickly is treated as a good outcome, and nobody is disciplined for falling for a well-crafted attack. It means senior people modelling it, an executive saying "I nearly paid that one" changes a culture faster than any module. It means thanking every report, including the false alarms, because a workforce that reports ten harmless emails to find one real attack is working exactly as intended. And it means never using simulation results to shame individuals, publicly or privately.
Organisations that get this right find that their detection improves before their prevention does, which is the correct order, because you cannot prevent everything.
A twelve-month programme that is not a module
A workable annual shape for a mid-sized organisation:
Quarterly, everyone: one short decision-based exercise, fifteen to twenty minutes, built around a scenario relevant to that group's actual work. Finance gets payment diversion; HR gets recruitment-themed lures and data requests; the help desk gets identity-verification pressure.
Twice yearly, high-risk roles: a longer facilitated session for finance, payroll, executive assistants, IT support and anyone with privileged access. These roles are targeted specifically and deserve specific preparation.
Annually, leadership: a facilitated crisis exercise covering the decisions only they can make: ransom posture, regulatory notification and public communication.
Continuously: a reporting channel that is genuinely easy to use, and visible follow-up so people see that reporting changes something.
On joining, and on role change: a short, specific briefing on the decisions that role will actually face. Not the full library.
Notice what is absent: an annual ninety-minute module covering everything for everybody. It is the most common design and the least effective.
Common objections, answered
"Our insurer or auditor requires completion records." Then keep a short baseline module for the record, and stop pretending it is your programme. Evidence of decision-based exercising is generally stronger assurance, not weaker.
"We cannot take people away from their jobs." Quarterly fifteen-minute exercises cost roughly an hour a year per person, less than most annual modules, and spread out.
"Our people are not technical." That is the point. These are business decisions under pressure, not technical skills. Non-technical staff perform well when the exercise is about judgement rather than jargon.
"We already run phishing simulations." Good, provided they are used to build reporting habits rather than to generate a click-rate chart. Phishing simulation is one input to a behaviour programme, not the programme itself.
Why this matters for leadership
Behaviour-led awareness is also a better story for the board. "We trained 300 decisions and improved challenge rates on suspicious payments" is a meaningful outcome. "94% completed the module" is not. Framing awareness around decisions connects security to the business risks leaders already understand: fraud, downtime and reputation.
It also maps more honestly onto assurance frameworks. NIST CSF 2.0, ISO/IEC 27001 Annex A and the NCSC Cyber Assessment Framework all expect awareness activity to be effective, not merely delivered. A record of exercised decisions, with observed improvement, answers that question far better than a completion percentage.
The bottom line
If your awareness programme measures completion, it is measuring compliance, not resilience. Shift the focus to the decisions that cause harm, rehearse them under realistic pressure, make it safe to be wrong, and measure how behaviour changes. That is what actually reduces risk.
Start with one thing: pick the single most expensive decision in your organisation, almost always a payment or a bank-detail change, and rehearse it with the people who make it. You will learn more in twenty minutes than from a year of modules.