--- title: "Latest Research Confirms the Ineffectiveness of Security Awareness Training | DuoCircle" description: "Security Awareness training companies love to point out how important employee training is in keeping organizations safe from ransomware and malware." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/" --- Quick Answer Security awareness training plateaus at around 98% effectiveness after a year of continuous program delivery, and 11+ courses over 4-6 months cuts phishing click-through by about 65%. In an organization with thousands of employees, even 2% click-through means dozens of malicious clicks per week, any one of which can compromise the network. Research also shows 1 in 4 workers know security guidelines but ignore them. Training is worth doing, but it cannot be the only defense. The reliable layer is real-time link-click protection that re-scans every URL on click against reputation databases, so a click on a malicious link is still blocked when training fails. Cloud-based phishing protection costs pennies per user per month and deploys in about 10 minutes. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Latest%20Research%20Confirms%20the%20Ineffectiveness%20of%20Security%20Awareness%20Training&url=undefined%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F&title=Latest%20Research%20Confirms%20the%20Ineffectiveness%20of%20Security%20Awareness%20Training "Share on Reddit") [ ](mailto:?subject=Latest%20Research%20Confirms%20the%20Ineffectiveness%20of%20Security%20Awareness%20Training&body=Check out this article: undefined%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F "Share via Email") ![security awareness training](https://media.mailhop.org/duocircle/images/2020/02/what-is-dkim-selector-7489.jpg) _Security Awareness training companies love to point out how important employee training is in keeping organizations safe from ransomware and malware_. And to be sure, training employees to spot phishing emails is better than not doing it. But, the ubiquity of **security awareness training** advertising has led to two large problems. First, _some organizations can get the impression that security awareness training for their employees is a sufficient first line of defense against malicious emails_. And on the limited budget most companies have, they may opt for [awareness training](/email-security/online-security-awareness-training-a-necessity-in-todays-digital-age/) over more effective (and cost effective) forms of defense. The second problem with awareness training is, it’s just not good enough. In most cases, when you reduce the risk of some adverse event by 65%, or 75%, or 98%, that’s a pretty good investment. But with a **phishing attack**, where a _single wrong click can bring down an entire organization with thousands of employees_, 98% effectiveness means there are potentially dozens of clicks on malicious links per week. The problem isn’t that the awareness training isn’t any good, it’s that human beings are, well, human. [![Phishing Problem](https://media.mailhop.org/duocircle/images/2020/02/dkim-validation-6718.jpg)](https://media.mailhop.org/duocircle/images/2020/02/dkim-validation-6718.jpg) This week, “_Running 11 or more training courses over 4-6 months reduces phishing click-through by 65%._” Put another way, if you conduct a training class every other week for half a year, _one in three employees will still click on malicious links_. From a company defense standpoint, that’s not much better than no training at all. Perhaps all that’s needed is MORE training. Not really. As previously detailed in the article [The Misguided Solution to the Phishing Problem](/phishing-protection/the-misguided-solution-to-the-phishing-problem/#more-14093), “after one year of continuous employee training, the best possible result is **98% effectiveness**. And that’s when employees care about security. What we also [know](https://www.darkreading.com/threat-intelligence/1-in-4-workers-are-aware-of-security-guidelines---but-ignore-them/d/d-id/1334492?%5Fmc=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190425&cid=NL%5FDR%5FEDT%5FDR%5Fweekly%5F20190425&elq%5Fmid=90687&elq%5Fcid=28171904) from research is that ‘_1 in 4 workers are aware of security guidelines, but ignore them_.’” Employee awareness training suffers from diminishing returns. All the training in the world [won’t get to 100% effective](/phishing-protection/now-we-know-why-you-cant-depend-on-awareness-training-to-stop-phishing-attacks/). And unfortunately, when it comes to cyber defense, anything less leaves you really vulnerable. [![phishing protection](https://media.mailhop.org/duocircle/images/2020/02/what-is-dkim-7352.jpg)](https://media.mailhop.org/duocircle/images/2020/02/what-is-dkim-7352.jpg) What’s the answer? You should still do employee training, BUT use it to augment the much more effective cloud-based [phishing protection](/email/phishing-protection) software like that available from DuoCircle. _Phishing Protection from DuoCircle comes with real-time link click protection_. So, when those trained employees fail to recognize a phishing email and click on a malicious link, _you’re still protected no matter when they click on it_. Is Phishing Protection cost effective? _How about pennies per employee per month_? You’d have a hard time finding employee training that inexpensive. It’s time to embrace the truth about awareness training. It’s good to have, but if you have to choose between training employees or protected employees, the answer is obvious: [DuoCircle.com](/). ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F) [ ](https://twitter.com/intent/tweet?text=Latest%20Research%20Confirms%20the%20Ineffectiveness%20of%20Security%20Awareness%20Training&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fphishing-protection%2Flatest-research-confirms-the-ineffectiveness-of-security-awareness-training%2F) Copy Related Articles - [ ![AI-Generated Phishing](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4522.jpg) AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Phishing ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/) - [ ![spf-permerror-4555](https://media.mailhop.org/duocircle/images/2023/05/spf-permerror-4555.jpg) 10 Applications of ChatGPT that Hackers Are Already Exploiting Phishing ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/) - [ ![Email-Based Cyber-Attacks](https://media.mailhop.org/duocircle/images/2016/03/spf-record-tester-4455.jpg) 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Phishing ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/) - [ ![Email-based Ransomware Attacks](https://media.mailhop.org/duocircle/images/2018/02/email-smtp-service-7834.jpg) 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Phishing ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ## Related Articles [ Phishing 11m AI-Generated Phishing Has Eliminated the Typo: Why Traditional Email Filters Are No Longer Enough Apr 28, 2026 ](/blog/ai-generated-phishing-eliminates-typos-making-traditional-email-filters-ineffective/)[ Phishing 5m 10 Applications of ChatGPT that Hackers Are Already Exploiting May 3, 2023 ](/blog/phishing-protection/10-applications-of-chatgpt-that-hackers-are-already-exploiting/)[ Phishing 4m 65% of Global Businesses Ill-Equipped to Defend Against Email-Based Cyber-Attacks Mar 29, 2016 ](/blog/phishing-protection/65-global-businesses-ill-equipped-defend-email-based-cyber-attacks/)[ Phishing 9m 7 Ways to Protect Your Organization from Email-based Ransomware Attacks Feb 11, 2018 ](/blog/phishing-protection/7-ways-protect-organization-email-based-ransomware-attacks/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Latest Research Confirms the Ineffectiveness of Security Awareness Training","description":"Security Awareness training companies love to point out how important employee training is in keeping organizations safe from ransomware and malware.","url":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/","datePublished":"2020-02-26T20:17:04.000Z","dateModified":"2025-06-18T14:12:17.000Z","dateCreated":"2020-02-26T20:17:04.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/"},"articleSection":"phishing-protection","keywords":"","wordCount":452,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/02/what-is-dkim-selector-7489.jpg","caption":"security awareness training","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Phishing"},{"@type":"ListItem","position":3,"name":"Latest Research Confirms the Ineffectiveness of Security Awareness Training","item":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Phishing","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Latest Research Confirms the Ineffectiveness of Security Awareness Training","item":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Latest Research Confirms the Ineffectiveness of Security Awareness Training","description":"Security Awareness training companies love to point out how important employee training is in keeping organizations safe from ransomware and malware.","url":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/","datePublished":"2020-02-26T20:17:04.000Z","dateModified":"2025-06-18T14:12:17.000Z","dateCreated":"2020-02-26T20:17:04.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/phishing-protection/latest-research-confirms-the-ineffectiveness-of-security-awareness-training/"},"articleSection":"phishing-protection","keywords":"","wordCount":452,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2020/02/what-is-dkim-selector-7489.jpg","caption":"security awareness training","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```