5 cybersecurity training program mistakes most companies make

Who's to blame for most security incidents? People -- that's the conclusion of multiple reports, surveys and studies.

"The evidence is overwhelming: Insider threats, credential misuse and user-driven errors account for most security incidents," wrote the authors of "The State of Human Risk 2026" report issued by cybersecurity platform Mimecast.

Other data provides more specific conclusions. Verizon's "2026 Data Breach Investigations Report," for example, pegged 62% of all data breaches to human missteps, such as errors, privilege misuse or social engineering.

And while most organizations have a cybersecurity awareness program in place to combat these vulnerabilities, those programs aren't nearly as effective as they could be.

The "SANS 2026 Security Awareness and Culture Report" found that only one-third of organizations maintain mature awareness programs. A mature program, according to SANS, drives long-term culture change or focuses on optimization and resilience, achieved by 21% and 12% of respondents, respectively. The other 67% are not as mature, and 3% said their organizations do not even have a security awareness program.

"Many organizations are sincere about awareness training, but they ask it to do more than the way it is delivered can accomplish," said Rick Gamache, senior director of standards and practice at ISC2, a nonprofit association for security professionals. "Someone can finish a module, pass a quiz and still be unsure what to do when an unexpected request appears in the middle of a busy workday."

So, what are the reasons these programs fail? Let's look at five common cybersecurity awareness program mistakes.

1. Treating training as a compliance exercise

When executives see training as a check-the-box task that involves only the minimum requirements -- say, a prescribed number of classes -- employees will participate but won't change what they do, said Tom Gould, director of cybersecurity at consulting firm West Monroe. "Even if a video equips workers with the right information on how to act, it doesn't change behavior. Just because you tell people to do it, doesn't mean they will."

Indeed, according to the SANS report, 19% of surveyed organizations have training programs designed primarily to meet specific compliance or audit requirements. Contractually or regulatory-required training still needs to occur, Gould said, but that can't be the full extent of education.

Gamache agreed. "For cybersecurity awareness training to be considered highly effective, I want to see employees recognize a concerning situation in the course of their normal work, take a sensible next step and feel comfortable asking for help," he said. "They should know how to verify an unusual request without relying on the contact details in the request itself. If they make a mistake, they should know how to report it promptly. Those are observable behaviors, and they tell us more than whether someone remembers an answer from an annual quiz."

2. Focusing on yesterday's threat landscape

The threat landscape changes quickly. To be effective, training programs must evolve just as rapidly, said Mike Baker, vice president and global CISO at consultancy DXC Technology. That's not to say programs should skip the basics, just that they shouldn't offer outdated examples of attack techniques.

Case in point: AI-optimized social engineering attacks. Some 40% of respondents to the "ISC2 Cybersecurity Workforce Study 2025" reported encountering an AI-driven social engineering attack in the past year. Workers must still be trained on phishing attacks, Baker said, but now they need to also spot them in the age of AI. No longer do misspellings and poor grammar -- telltale signs of a phishing attempt a decade ago -- signal that a social engineering attack is underway.

3. Teaching security for yesterday's tech stack

Programs that focus on teaching employees how to stay safe on legacy technology are ineffective, Baker said. That might seem obvious, but given how fast technology -- particularly AI -- is evolving, it can be hard to keep up.

For instance, a training program that details how to safely use GenAI but doesn't address agentic AI will not help employees understand current security requirements. Baker said security leaders need to review their cybersecurity awareness programs with as much vigor as they do on the technical and tool side to ensure they evolve as needed.

4. Taking a one-size-fits-all approach

Some security awareness training is applicable to all employees at every level, but a one-size-fits-all approach is insufficient. Companies that do this risk failing to adequately arm employees with the information they need to defend themselves and the organization against the threats they're most likely to encounter, Gould said.

Take the 2023 Caesars Entertainment attack, for example. It started when a malicious actor impersonated a Caesars employee over the phone and persuaded an outsourced help desk vendor to issue a new password and reset the MFA for a privileged account. This hack could happen at any help desk; all help desk workers must know how to spot such attempts. But training finance workers to recognize this type of attack wouldn't lower risk. It would be better to teach them how to spot deepfakes and fraudulent invoices -- the types of attacks they'd likely encounter.

Baker said that he takes this approach at DXC. The company's phishing awareness program uses AI to send personalized emails to each employee in the organization, crafted to the individual's role and location. How employees respond -- whether they fall for the phishing simulation or not -- helps DXC more precisely direct remedial training and track improvement over time, Baker said.

5. Providing too little information

Some cybersecurity training mistakes stem from programs that are too narrow in scope, Gould said. A company, for example, might run campaigns that educate staff on how to spot phishing attacks, why they're dangerous and how to report them. But that doesn't address how QR codes or vishing phone calls can also be used to start an attack.

Similarly, Gamache said he has seen training programs that lack sufficient follow-up education to let workers test their knowledge, practice their responses and learn from their mistakes.

"An employee may understand that phishing exists and still respond to a request that appears to come from a colleague who needs something urgently," he said. "I would look at what happens around that decision. Does the employee know how to verify the request through a trusted channel? Is there an easy way to report it? Will they feel comfortable asking for help? Training becomes more useful when people have practiced those steps and can take them under pressure."

Mary K. Pratt is an award-winning freelance journalist with a focus on covering enterprise IT and cybersecurity management.