# Security Awareness Training Is Broken. Human Risk Management Is What Replaces It.

> Annual modules and click-rate dashboards can produce compliance without resilience. What a modern human-risk program measures instead, and why boards care.

- URL: https://www.awarexone.com/research/security-awareness-training-is-broken
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026 (updated 2026-09-28)
- Topics: Human risk, Program design
- Related service: Social engineering and training: https://www.awarexone.com/services/social-engineering

## Short answer

Annual training alone is not enough because it shows who finished a course, not who would verify an unusual payment or report a suspicious call under pressure. Keep training, but add role-based learning, independent checks and dual approval for payments and account resets, and measure reporting and verification over time. Make reporting safe, because blame makes people hide mistakes.

## Summary

- Annual training shows who finished a course, not who would verify an unusual payment or report a suspicious call under pressure.
- Training is still useful, but human risk management adds role-based learning, better processes, supporting controls and measuring behaviour over time.
- Click rate alone is a weak measure, because it depends on how hard the test email is. Reporting, verification and escalation matter more.
- Much of the risk sits in the process, so add independent checks and dual approval for payments, bank changes and account resets.
- Blame makes people hide mistakes. Make reporting easy and safe, because an early report from the person who clicked is the most useful warning.
- Human risk work supports technical security such as patching and MFA, it does not replace it, and any testing must be authorised and scoped.

Every employee finishes the annual security module. Completion reaches 100 per cent, the audit evidence is filed, and the dashboard turns green. Three months later a message lands in the finance inbox that appears to come from the managing director: an urgent supplier payment, new bank details, a request to keep it quiet until a deal is announced. Or the IT help desk takes a call from someone who sounds exactly like a senior manager locked out before a board meeting.

The person handling it did the training. They may even remember the module. But the approval process has no independent check, the requester's seniority discourages questions, and nothing in the workflow forces a pause. The payment goes out, or the reset goes through.

That is not a training failure in the narrow sense. It is a measurement failure. The organisation measured whether people completed a course, not whether its people and processes could resist a convincing request under pressure.

Last checked: 28 September 2026.

## Why Isn't Annual Security Awareness Training Enough?

Security awareness training teaches knowledge and expected behaviours, but training completion alone does not measure organisational human cyber risk. An annual module happens once, covers generic scenarios and produces a completion rate: a number that shows who finished a course, not who would verify an unusual payment request or report a suspicious call. Large field studies have found weak links between recent training completion and simulated phishing outcomes. Attackers also target workflows, not just inboxes: payment approvals, account resets, supplier changes. Human risk management expands the focus from training participation to identifying, measuring, reducing and monitoring human-related cyber risk, using role-specific learning, better processes, supporting controls and behaviour measurement over time. Training remains part of the program. It stops being the whole of it.

## The Human Risk Loop: Know, Measure, Intervene, Test, Improve

A working human-risk program runs as a loop rather than an annual event:

1. Know. Which roles, workflows and accounts create or amplify human-driven risk, and what attackers can learn about them from public sources.
2. Measure. Baseline the behaviours that matter, such as reporting, verification and escalation, not only completion and clicks.
3. Intervene. Change what people know (role-based learning), what they are expected to do (clear procedures) and what the environment allows (controls).
4. Test. Run authorised, scoped exercises to check whether the changes hold under realistic pressure.
5. Improve. Feed test results, incidents and near misses back into training, process and control decisions.

The loop does not finish. That is the point.

## 1. What Security Awareness Training Gets Right

Training gives people a shared vocabulary, sets expectations and tells them where to report. Those are real outcomes, and nothing in this article argues for removing it.

The current guidance keeps it central. NIST SP 800-50 Rev. 1 (September 2024), which replaced NIST's 2003 awareness guidance, still treats a mandatory organisation-wide learning program as a core element. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 recommend at least annual cybersecurity training for all users, plus role-based training for specialised roles including finance and senior leadership. For some regulated Malaysian entities, annual awareness training is a regulatory requirement (see section 19).

The criticism here is narrower: security awareness training is useful, but a compliance-only annual training model is insufficient for managing modern human cyber risk.

## 2. Where the Traditional Model Breaks

The traditional model has predictable weak points:

- Frequency. Once a year, against threats that change monthly.
- Generic content. The same module for the payroll clerk and the system administrator.
- The wrong measure. Completion shows attendance, not behaviour.
- People without process. It trains individuals while leaving single-approver workflows untouched.
- A dead end. The course finishes, and nothing feeds back into how the organisation works.

The research supports caution about completion as a proxy. In an eight-month randomised study of more than 19,500 employees at UC San Diego Health (Ho et al., IEEE Symposium on Security and Privacy 2025), the researchers found no significant relationship between recently completing annual awareness training and failing a simulated phish. Training shown immediately after a click reduced failure by about 1.7 percentage points across the population, and more than half of those training sessions were closed within 10 seconds. The study covers one organisation and measures simulations rather than real breaches, but it is hard to read it as endorsing completion as a risk measure.

An earlier 15-month study of about 14,700 employees at one company (Lain, Kostiainen and Čapkun, IEEE S&P 2022) found that voluntary training shown after a click was associated with more failures, not fewer. The authors stress that they did not test mandatory training.

NIST's own position is plain: meeting compliance requirements "should only be the starting point" for a learning program.

## 3. Click Rate Is a Metric, Not a Risk Model

Phishing click rate is a useful metric for a specific simulation, but it does not represent total human risk. It is heavily shaped by how difficult the test email is. NIST's Phish Scale research (Steves, Greene and Theofanos, Journal of Cybersecurity, 2020) found that exercises rated very difficult drew click rates of 19.4 to 49.3 per cent, while the others ranged from 3.2 to 11.6 per cent. A team can improve its click rate simply by sending easier emails.

The NACD's 2026 board handbook still lists click rate as an example culture metric, and that is reasonable as one input among several. The problem starts when it becomes the only number.


| Metric | What it tells you | What it does not tell you |
| --- | --- | --- |
| Training completion | Who finished the assigned course | Whether anyone behaves differently afterwards |
| Phishing click rate | How many people clicked one simulated email of one difficulty | How the organisation would handle a phone call, message or deepfake |
| Report rate | How many people flagged a suspicious message | Whether reports reach someone who acts on them |
| Time to report | How quickly the organisation gets an early warning | Whether the threat was contained |
| Repeat failures | Where support or process changes may be needed | Why it happened: workload, role design, poor tooling |
| Data entered on a test page | How far a simulated attack progressed | Whether controls such as phishing-resistant MFA would have stopped it |

## 4. What Human Risk Management Adds

Human risk management is the continuous process of identifying, measuring, reducing and monitoring cybersecurity risks created or amplified by human behaviour and human-dependent business processes.

A note on terminology: "human risk management" is an industry and analyst term, not a formal standard. Forrester adopted it as its market name in February 2024, retiring "security awareness and training"; Gartner uses different language, including "security behaviour and culture program". NIST SP 800-50 Rev. 1 mentions "human risk management concerns" only to say they fall outside its scope. The label matters less than the shift it describes.

Human risk management expands the focus from training participation to identifying, measuring, reducing and monitoring human-related cyber risk. In practice it adds four things the annual model lacks: a view of risk by role and workflow, measurement of behaviour over time, changes to controls and processes, and governance reporting that leadership can act on.

## 5. Human Risk Depends on the Role

Exposure follows authority and access, not intelligence or diligence.

- Finance: payment approvals, supplier onboarding and bank-detail changes.
- IT and help desk: password resets, MFA re-enrolment and access grants.
- HR: personal data, payroll changes and recruitment channels open to anyone.
- Executives: public profiles, recorded voices and faces, and the authority impersonators borrow.
- Developers: code repositories, secrets, cloud access and third-party packages.
- Customer support: account-change requests from people claiming to be customers.

Much of what an attacker needs to target these roles is public. Our analysis of [how attackers use OSINT to research a company](https://www.awarexone.com/research/osint-how-attackers-research-your-company) shows how organisation charts, job posts and social profiles become pretexts. A higher-risk role is a design input, not an accusation.

## 6. Risk Is Often in the Process, Not the Person

If one email can change a supplier's bank account, the risk sits in the process. Asking an individual to be sceptical every time, under deadline pressure, is a weak control.

Business email compromise shows the scale. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints and about US$3.05 billion in reported losses in 2025. Those are complaints to IC3, mainly from the United States, not a global incidence rate. In Malaysia, the Royal Malaysia Police's "Kenali BEC" advisory advises verifying payment requests by phone or another channel.

Process questions worth asking:

- Does any high-value action depend on one person and one channel?
- Can urgency or seniority override the normal check?
- Is there a named person to call when something feels wrong?
- Are bank-detail changes verified against information already on file?

## 7. The Human Risk Stack

Effective human-risk programs combine people, process, technology, measurement and governance. One way to structure them:

1. Awareness: people recognise that manipulation exists and know where to report.
2. Skills: role-specific practice in the decisions each role actually makes.
3. Process: verification, dual approval and escalation built into workflows.
4. Technology: controls that remove or reduce the decision, such as phishing-resistant MFA and email authentication.
5. Measurement: behavioural data tracked over time against the organisation's own baseline.
6. Governance: ownership, reporting to leadership and a budget tied to risk.

Most annual programs stop at the first layer.

## 8. Role-Based Scenarios

Training works better when it rehearses the decisions a role really makes. The scenarios below describe situations and the desired defensive response; they are not test content.


| Role | Scenario | Desired behaviour |
| --- | --- | --- |
| Finance | A message that appears to be from a known supplier announces new bank details before a large invoice | Verify using contact details already on file, apply dual approval and report the request |
| IT help desk | A caller claiming to be a senior manager urgently needs an MFA reset | Follow the identity-verification procedure regardless of seniority, and escalate if pressured |
| HR | An email asks to change an employee's payroll account | Confirm with the employee through a known channel before any change |
| Executive | A video call from "the CEO" asks for a confidential transfer | Pause and verify through a separate, pre-agreed channel with a second approver ([how to verify a suspicious video call](https://www.awarexone.com/research/deepfake-video-call-verification)) |
| Creator or public-facing account | A message from "platform support" says the account will be disabled unless you log in through a link | Ignore the link, check status in the official app and report the message ([social media security in Malaysia](https://www.awarexone.com/research/social-media-security-malaysia)) |

## 9. Measure Behaviour, Not Just Knowledge

Awareness is knowing that callback verification exists. Behaviour is doing it when a senior executive is pressing for a payment. Programs should measure the second:

- Detection: did people notice something was wrong?
- Verification: did they check through an independent channel?
- Reporting: did they tell the security team, and how quickly?
- Escalation: did the report reach someone who could act?
- Recovery: after a mistake, was it disclosed and contained quickly?
- Repeat behaviour: does the same failure recur in the same role or workflow?

NIST SP 800-50 Rev. 1 lists incident-reporting metrics and "longitudinal data that depicts program impacts, including employee behavior change" among example measures.

## 10. Measure Improvement Over Time

A single test is a snapshot. Improvement needs a sequence:

1. Before: a baseline of behaviour and process before any intervention.
2. During: engagement with the intervention, not just attendance.
3. Immediately after: early behaviour change in simulations or exercises.
4. Later: whether it persists weeks or months on.
5. Compare: like with like, meaning the same role, channel and difficulty. The Phish Scale research is the reason this matters.

## 11. Change the Environment, Not Just the Person

The most reliable way to reduce human risk is to take risky decisions out of individual hands where possible:

- Phishing-resistant MFA for email, administrator, finance and social accounts. CISA's Performance Goals 2.0 rank FIDO/WebAuthn or PKI-based methods as the strongest option. See our guide to [setting up two-factor authentication properly](https://www.awarexone.com/research/two-factor-authentication-instagram-facebook-tiktok).
- Dual approval and a hold period for new payees and bank-detail changes.
- Callback to contact details already on file, never to details in the request.
- Documented help desk identity verification that seniority cannot override.
- Email authentication, external-sender warnings and a one-click report button. The 2022 ETH Zurich study found that warnings on emails did help.
- Least privilege, so that one compromised account reaches less.

This is where human-risk work meets [technical cybersecurity services](https://www.awarexone.com/services/cybersecurity).

## 12. Reporting Behaviour Is a Signal

Reporting may be the most useful human metric an organisation has. In security-awareness vendor data analysed in the Verizon 2025 Data Breach Investigations Report, users who had recently been trained reported simulated phishing at about 21 per cent, against a base rate of 5 per cent, while the effect on click rate was far smaller. That data is observational, not causal, but it points in a clear direction.

In the ETH Zurich study, staff reports caught real phishing campaigns quickly. About 10 per cent of reports on simulated emails arrived within five minutes, and only 9 per cent of 7,191 real reported emails needed a human decision.

Reporting turns employees into an early-warning network. It works only if reporting is easy, acknowledged and safe.

## 13. Why Fear-Based Cultures Backfire

The UK National Cyber Security Centre is direct: "blaming users for clicking on links doesn't work", and "employees who are afraid for their jobs will not report mistakes." Its Cyber Security Culture Principles (June 2025) ask that incidents be investigated "to learn and improve, not to blame." NIST SP 800-50 Rev. 1 recommends encouraging behaviour change "in positive, non-punitive ways."

The experimental evidence on punishment is mixed. Some studies find that sanctions reduce repeat clicking, and others record costs in perceived unfairness and anxiety. The stronger case against fear is practical: the most valuable signal an organisation can get is an early report from the person who made the mistake, and that depends on trust. Why social engineering works at all is covered in [the psychological levers attackers use](https://www.awarexone.com/research/six-psychological-levers-social-engineers-use); a punitive culture adds another lever to the attacker's side.

## 14. What a Human Risk Dashboard Should Show

A useful dashboard is organised around risk, not training administration:

- Exposure: high-risk roles, privileged accounts and public-facing individuals.
- Behaviour: reporting, verification and escalation trends by role and department.
- Controls: MFA coverage, dual-approval coverage and process exceptions.
- Testing: what was tested, which channel, at what difficulty and what changed.
- Incidents: real incidents and near misses with a human or process component.

Show trends against the organisation's own baseline, not borrowed industry benchmarks. Aggregate by role and department, not individual league tables.

## 15. Questions Boards Should Ask

The NACD's 2026 Director's Handbook on Cyber-Risk Oversight (fifth edition, with the Internet Security Alliance) includes a tool on overseeing insider threats and human risk management. It asks boards to review whether awareness training is effective in reducing poor security behaviours and whether the program shows improvement over time. The questions below draw on that guidance. They are governance recommendations, not a legal requirement or universal practice.

1. Which roles and workflows carry the most human-driven cyber risk?
2. Which high-value actions rely on a single person or channel?
3. Is our training effective in reducing poor security behaviours, and how do we know?
4. Are reporting and verification improving over time?
5. How are phishing-resistant MFA and dual approval deployed across critical accounts?
6. What did recent incidents and near misses teach us?
7. Do the CISO and HR work together on culture and insider risk?
8. Are our tests authorised, scoped and comparable over time?
9. Where do business pressures override security procedures?
10. What will change next quarter, and who owns it?

For context only: since the US Securities and Exchange Commission's 2023 rules, SEC-registered public companies must disclose material cybersecurity incidents and describe their cyber risk management and board oversight annually. Those rules do not apply to Malaysian companies that are not SEC registrants. For Malaysian listed companies, the Malaysian Code on Corporate Governance guidance names cyber security among the key risk areas boards should discuss.

## 16. What the CISO Should Report

A concise quarterly human-risk report can follow eight headings:

- Risk: the top human and process risks, in business terms.
- Exposure: changes in high-risk roles, access and public footprint.
- Controls: coverage and gaps in verification, MFA and approvals.
- Behaviour: reporting, verification and escalation data.
- Trend: direction against the organisation's own baseline.
- Exceptions: where controls were bypassed, and why.
- Incidents: real events and near misses with a human component.
- Actions: what is changing, who owns it and by when.

## 17. Human Risk Management Is Not a Replacement for Security Controls

Human risk management complements technical security controls rather than replacing them.

The breach data is explicit. The Verizon 2026 Data Breach Investigations Report, covering more than 22,000 confirmed breaches across 145 countries between November 2024 and October 2025, found that exploiting vulnerabilities was the leading initial access vector at 31 per cent, ahead of phishing at 16 per cent and credential abuse at 13 per cent. Pretexting was 6 per cent. The report found a non-intentional human element in 62 per cent of breaches. Separately, Microsoft Incident Response investigations for the Microsoft Digital Defense Report 2025 (July 2024 to June 2025) found that 28 per cent of breaches began with phishing or social engineering. That figure comes from Microsoft's own incident response engagements, not all organisations.

People matter, and so do patching, identity controls and monitoring. We explain [why social engineering can bypass a strong security stack](https://www.awarexone.com/research/why-social-engineering-beats-your-security-stack); the reverse is also true.

## 18. How AI Changes Human Risk

AI makes impersonation cheaper and more convincing. The FBI warned in December 2024 that criminals use generative AI for fraud, including cloned voices and real-time video chats with alleged company executives. In May 2025 it warned of AI-generated voice messages impersonating senior US officials. In early 2024, engineering firm Arup reported losing about HK$200 million (roughly US$25 million) in Hong Kong after an employee joined a video call with a digitally cloned chief financial officer, as reported by CNN.

The implication for human-risk programs is simple: "it sounded like her" is no longer verification. Procedures must not depend on recognising a face or voice. Read more on [AI voice cloning attacks](https://www.awarexone.com/research/ai-voice-cloning-attacks) and how organisations are adjusting.

## 19. Human Risk for SMEs in Malaysia

The official figures show the pressure. CyberSecurity Malaysia's Cyber999 centre handled 7,616 reported incidents in 2025, of which 5,751 were fraud. These are voluntary reports to Cyber999, not a measure of total incidence. The Royal Malaysia Police put 2025 online scam losses at RM2.97 billion, up from RM1.57 billion in 2024.

It helps to separate law, regulation and best practice:

- Legal duties. The Cyber Security Act 2024 (Act 854), in force since 26 August 2024, places duties on designated national critical information infrastructure entities. It contains no general staff-training requirement for ordinary businesses.
- Sector regulation. Bank Negara Malaysia's Risk Management in Technology policy (November 2025) requires financial institutions to provide cybersecurity awareness education at least annually and to measure its effectiveness. The Securities Commission's Guidelines on Technology Risk Management require annual awareness training for capital market entities.
- Voluntary best practice. For most SMEs, none of these apply directly. A human-risk program is good practice, not a legal duty.

SME realities shape the risk: founders approving payments by message, small finance teams without a second approver, heavy reliance on agencies and suppliers, and public-facing founders whose identity is easy to borrow (see [digital identity protection](https://www.awarexone.com/digital-identity-protection)). If money has just been transferred without authorisation, contact your bank's hotline or the National Scam Response Centre on 997 immediately, then lodge a police report. Incidents can also be reported to Cyber999.

## 20. A 90-Day Human Risk Plan for Malaysian Businesses

This is a practical sequence, not an official or regulatory timetable.

Days 1 to 30: Know

- List who can move money, reset accounts, change supplier details and publish on official channels.
- Check MFA on email, banking, administrator and social accounts.
- Set up one clear reporting channel and a named contact.
- Review what is publicly visible about key staff and processes.

Days 31 to 60: Intervene

- Add independent verification and dual approval for payments and bank-detail changes.
- Document help desk identity verification.
- Run short role-specific sessions for finance, IT, HR and leadership.
- Have leadership state, in writing, that reporting a mistake will not be punished.

Days 61 to 90: Test and improve

- Run an authorised, scoped exercise, either a tabletop or a simulation, with written approval, a defined scope and an emergency stop contact.
- Measure reporting and verification, not only clicks.
- Brief leadership on the results and set next quarter's priorities.

## 21. Traditional Model vs Human-Risk Model


| Dimension | Traditional awareness model | Human-risk model |
| --- | --- | --- |
| Goal | Compliance evidence | Reduced, measured human and process risk |
| Frequency | Annual | Continuous, with regular touchpoints |
| Content | Generic modules | Role- and workflow-specific |
| Primary metric | Completion and click rate | Reporting, verification and trend |
| Focus | Individual knowledge | People, process and controls together |
| Response to failure | Retraining or blame | Coaching and process redesign |
| Controls | Out of scope | Integral: MFA, approvals, verification |
| Board reporting | Completion percentage | Risk, trend, exceptions and actions |

## 22. What Human Risk Management Does NOT Mean

- Not monitoring employees' personal messages or private lives.
- Not personality or psychological scoring of individuals.
- Not naming and shaming, or individual league tables for the board.
- Not a disciplinary tool for simulation clicks.
- Not abandoning awareness training.
- Not a substitute for patching, identity controls and monitoring.
- Not deceptive testing without written authorisation and agreed scope.
- Not ignoring privacy law or employment obligations.

## How AwareXone Approaches Human-Layer Security

We work on a simple cycle: Test, Observe, Coach, Improve.

Our [social engineering and human-layer testing services](https://www.awarexone.com/services/social-engineering) include:

- Test. An OSINT exposure baseline, then phishing, voice, SMS, callback and deepfake scenarios. Every engagement runs under written authorisation, a defined scope, agreed scenarios, safety controls and an emergency stop contact.
- Observe. We look at how people and processes respond: who reported, who verified, where a workflow allowed a request through. Reports do not name individuals.
- Coach. Coaching after each test, and workshops for finance, HR, IT support and leadership.
- Improve. Results are broken down by department, role and trend, and presented in board-level reporting. Technical gaps found along the way connect to our [cybersecurity services](https://www.awarexone.com/services/cybersecurity).

Testing shows how processes respond on the day. It does not guarantee future behaviour, and we do not claim it does. How we handle authorisation, data and disclosure is set out in our [Trust Center](https://www.awarexone.com/trust).

## The 10-Point Human Risk Check

- We know which roles face the highest human-driven cyber risk.
- High-risk workflows have independent verification.
- MFA is enabled for important accounts.
- Employees have a clear reporting channel.
- Managers do not pressure employees to bypass controls.
- Training is role-specific where appropriate.
- Social-engineering simulations are authorised and scoped.
- We measure reporting and verification behaviour.
- We learn from incidents and near misses.
- Leadership receives meaningful risk metrics.

## Frequently Asked Questions

### Is security awareness training still effective?

It is useful for building shared knowledge, setting expectations and telling people how to report. Field research suggests that annual completion on its own has a weak link to behaviour, so training works best as one part of a program that also changes processes, controls and measurement.

### What is human risk management in cybersecurity?

Human risk management is the continuous process of identifying, measuring, reducing and monitoring cybersecurity risks created or amplified by human behaviour and human-dependent business processes. It is an industry term rather than a formal standard.

### Is human risk management replacing security awareness training?

No. It widens the scope. Awareness training stays in the program, alongside role-specific learning, process controls, behaviour measurement and governance reporting.

### Why is phishing click rate not enough to measure human risk?

Click rate reflects one simulated email at one difficulty level. NIST research shows it varies widely with how hard the email is, and it says nothing about phone, message or deepfake requests, or about whether controls would stop an attack.

### What should a human risk dashboard measure?

Exposure (high-risk roles and accounts), behaviour (reporting, verification and escalation), control coverage (MFA and dual approval), testing results by difficulty and channel, and incidents or near misses. It should show trends against the organisation's own baseline, aggregated by role rather than by individual.

### How do you measure employee cybersecurity behaviour?

Measure what people do in realistic situations: whether they detect, verify, report and escalate, and how quickly. Compare results over time using like-for-like tests, and combine them with real incident and near-miss data.

### How can businesses reduce human cyber risk?

Map high-risk roles and workflows, add independent verification and dual approval to high-value actions, deploy phishing-resistant MFA, make reporting easy and safe, train by role, and test with authorised, scoped exercises.

### What is the difference between awareness and behaviour?

Awareness is knowing what a safe action looks like. Behaviour is taking that action under real pressure, such as verifying a payment request when a senior executive is demanding speed.

### How should boards oversee human cyber risk?

NACD's 2026 handbook suggests that boards review whether training reduces poor security behaviours, whether the program improves over time, and whether security and HR leaders work together. Boards should ask for risk and trend reporting, not completion percentages.

### Does human risk management replace technical security?

No. Human risk management complements technical security controls rather than replacing them. Verizon's 2026 breach data shows vulnerability exploitation as the leading initial access vector, so patching and identity controls remain essential.

### How should SMEs build a human risk program?

Start small: identify who can move money or reset accounts, add verification to those workflows, enable MFA, set up one reporting channel, and run a short authorised exercise. For most Malaysian SMEs this is voluntary best practice rather than a legal requirement.

### How can businesses test social-engineering resilience safely?

Use written authorisation, a defined scope, agreed scenarios, safety controls and an emergency stop contact. Avoid collecting real credentials, keep individuals anonymous in reporting, and follow every test with coaching rather than blame.

## Official sources

- [NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program, September 2024. US federal guidance; voluntary for other organisations](https://csrc.nist.gov/pubs/sp/800/50/r1/final)
- [CISA, Cross-Sector Cybersecurity Performance Goals 2.0 (October 2025), goals 3.J (training) and 3.F (MFA)](https://www.cisa.gov/cybersecurity-performance-goals-2-0-cpg-2-0)
- [CISA, "Implementing Phishing-Resistant MFA" fact sheet, October 2022](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf)
- [NACD and Internet Security Alliance, Director's Handbook on Cyber-Risk Oversight, 5th edition, 2026. Tool G (insider threats and human risk management); Tool K (click rate as an example metric)](https://www.nacdonline.org/globalassets/public-pdfs/2026_directors-handbook-cyber-risk_print.pdf)
- [Verizon 2026 Data Breach Investigations Report. Incidents from 1 November 2024 to 31 October 2025; 22,000+ confirmed breaches; 145 countries. Initial access: exploitation 31%, phishing 16%, credential abuse 13%, pretexting 6%. Human element 62%](https://www.verizon.com/business/resources/T158/reports/2026-dbir-data-breach-investigations-report.pdf)
- [Verizon 2025 Data Breach Investigations Report. Security-awareness vendor simulation data: reporting about 21% after recent training against a 5% base; about 5% relative effect on click rate. Observational](https://www.verizon.com/business/resources/reports/dbir/)
- [Microsoft Digital Defense Report 2025. Fiscal year 2025 (1 July 2024 to 30 June 2025); global Microsoft Incident Response engagements. 28% of breaches initiated through phishing or social engineering](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025)
- [FBI IC3, 2025 Internet Crime Report, published 6 April 2026. Complaints in calendar year 2025, mainly US. Business email compromise: 24,768 complaints and US$3,046,598,558 in reported losses](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI PSA I-120324-PSA, 3 December 2024: generative AI used for financial fraud](https://www.ic3.gov/PSA/2024/PSA241203)
- [FBI PSA I-051525-PSA, 15 May 2025: AI voice messages impersonating senior US officials](https://www.ic3.gov/PSA/2025/PSA250515)
- [CNN, 16 May 2024: the Arup deepfake case in Hong Kong (HK$200m, about US$25m)](https://www.cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk)
- [Ho et al., "Understanding the Efficacy of Phishing Training in Practice", IEEE S&P 2025. Eight months; 19,500+ employees at UC San Diego Health (US); a single organisation](https://arianamirian.com/docs/ieee-25.pdf)
- [Lain, Kostiainen and Čapkun, "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study", IEEE S&P 2022. 15 months (July 2019 to October 2020); about 14,700 employees at one company](https://arxiv.org/abs/2112.07498)
- [Steves, Greene and Theofanos, "Categorizing human phishing difficulty: a Phish Scale", Journal of Cybersecurity 6(1), 2020. Ten NIST exercises](https://doi.org/10.1093/cybsec/tyaa009)
- [UK NCSC, "Phishing attacks: defending your organisation", reviewed February 2024](https://www.ncsc.gov.uk/guidance/phishing)
- [UK NCSC, Cyber Security Culture Principles, June 2025](https://www.ncsc.gov.uk/collection/cyber-security-culture-principles)
- [SEC press release 2023-139, 26 July 2023: cybersecurity disclosure rules for SEC registrants](https://www.sec.gov/newsroom/press-releases/2023-139)
- [Forrester, "Introducing Human Risk Management", 13 February 2024: origin of the market term](https://www.forrester.com/blogs/the-future-is-now-introducing-human-risk-management/)
- [CyberSecurity Malaysia, Cyber999 incident statistics 2025, January to December 2025. Voluntary reports to Cyber999: 7,616 in total, 5,751 fraud](https://www.cybersecurity.my/portal-main/statistics-details?id=24)
- [Bernama, 15 June 2026: Inspector-General of Police on 2025 online scam losses of RM2.97 billion (RM1.57 billion in 2024)](https://www.bernama.com/en/news.php?id=2568694)
- [Royal Malaysia Police (CCID), "Kenali BEC" advisory, October 2025, updated August 2026](https://rmp2u.rmp.gov.my/content/posting-pilihan-kenali-bec)
- [NACSA, Cyber Security Act 2024 (Act 854), in force 26 August 2024](https://www.nacsa.gov.my/act854.php)
- [Bank Negara Malaysia, Risk Management in Technology, 28 November 2025. Para. 15.1: annual awareness education, with effectiveness measured](https://www.bnm.gov.my/-/pd-rmit-nov25)
- [Securities Commission Malaysia, Guidelines on Technology Risk Management (SC-GL/2-2023 (R1-2024)), para. 5.05](https://www.sc.com.my/regulation/guidelines/technology-risk)
- [Securities Commission Malaysia, Malaysian Code on Corporate Governance (2021), Guidance G10.2](https://www.sc.com.my/api/documentms/download.ashx?id=239e5ea1-a258-4db8-a9e2-41c215bdb776)
- [NFCC, National Scam Response Centre (997)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc)
- [MyCERT, Cyber999 incident reporting](https://www.mycert.org.my/portal/full?id=9eb77829-7dd4-4180-814f-de3a539b7a01)

---

AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.