- Most employees already know about phishing, but under pressure—facing AI-generated, highly personalized attacks—they click anyway. Traditional training measures like completion rates and simulated click rates look good on paper but don't reflect actual risk.
- Mimecast's data indicates that roughly 8% of employees account for 80% of security incidents, yet one-size-fits-all training programs fail to identify or address these high-risk individuals because risk signals are scattered across disconnected tools.
- Rather than relying on scheduled training, organizations need to connect risk signals across the security stack to build individual risk profiles and deliver brief, contextual nudges at the moment risky behavior occurs—turning security from a compliance exercise into something with which employees personally engage.
Blog
The gap isn't knowledge—it's behavior
Why security awareness training is becoming security behavior management
By The Mimecast Cyber Insights Blog Team
Key Points
Security awareness training has a metrics problem—not because the metrics look bad, but because they look good. Completion rates are up. Simulated phishing click rates have come down. The quarterly board report reflects steady progress.
And yet, the breaches keep happening. Credentials keep getting stolen. Employees keep clicking links they shouldn't, uploading data to places they shouldn't, and responding to requests they should have questioned.
This isn't a failure of awareness. It's a failure of the model. The problem was never that people don't know about phishing—it's that under pressure, juggling dozens of applications and responding to an email that looks exactly like it came from their CFO, they click anyway. The gap isn't knowledge. It's action.
The threat landscape has moved on
Attackers now use AI to generate highly personalized phishing emails in seconds, clone executive voices, and adapt lures in real time. According to ENISA's 2025 Threat Landscape, AI-supported phishing represents more than 80% of observed social engineering activity worldwide. Per Mimecast's 2025 Global Threat Intelligence Report, 77% of all cyberattacks now begin with phishing, up from 60% just a year earlier.
When the suspicious email is nearly indistinguishable from a legitimate one—AI-generated, personalized, sent from a spoofed domain—"spot the typo" doesn't hold up as a strategy. The response can't be more awareness. It has to be smarter intervention, grounded in what employees actually do.
Human risk has a shape—and it's not evenly distributed
At Mimecast, we break human risk into three dimensions. Action—well-intentioned mistakes made under pressure. Attack—when employees are deliberately targeted through phishing, BEC, or AI-generated lures. And Access—when legitimate access gets misused, whether uploading sensitive data to an unapproved AI tool, privilege abuse, or taking IP on the way out.
What this framework reveals is that human risk is not evenly distributed. Our data shows that as few as 8% of employees are responsible for 80% of security incidents—consistent across organizations of every size and industry. A one-size-fits-all training program doesn't just fail to address that 8%—it makes them invisible.
Related Tags
- Security Behavior Management
