TL;DR: Cyber security training has earned some of its bad reputation, from time-consuming modules and forgettable advice to repetitive content and the feeling of being watched, so it’s worth asking what training would look like if people actually wanted to use it.
Cyber security has a bit of an image problem.
Having spoken to enough people in and around the industry, it’s easy to understand why mentioning cyber security doesn’t always bring a smile. People generally understand that it’s important. They also understand that someone, somewhere, probably wants their passwords, money or data. Yet mention mandatory cyber security training and the mood can change rather quickly.
Suddenly, there’s a meeting that could’ve been an email, a presentation that could’ve been three bullet points and another phishing simulation that looks suspiciously like the last phishing simulation. There’s another quiz about passwords, another module to complete and another box to tick before the working day can get back under way.
Research has found that employees can have distinctly negative perceptions of security awareness training. One academic study of employee experiences described training as boring and examined how content, delivery, organisational culture and people’s existing beliefs about cyber security affect how receptive they are to it. (sciencedirect.com)
A later study involving 457 working adults went further, developing a measure of “cybersecurity advice fatigue”. Its researchers found that people form judgements about why security training exists and that these perceptions can affect how receptive they are to the advice. (sciencedirect.com)
So, in the spirit of looking directly at the problem, here are some of the things people seem to hate most about cyber security.
1. The Great Calendar Block
Few things lower enthusiasm faster than an email announcing that everyone needs to complete their annual cyber security training. Thirty minutes have mysteriously disappeared from the working day, and the frustration isn’t simply about the time involved; it’s about losing time that was earmarked for actual work.
Research from the US and UK reflects that tension. In one 2023 survey of 1,000 office workers, 66% said completing daily tasks took priority over cyber security training. The UK Government’s cyber security research has also found that some businesses struggle to provide more frequent or interactive training because of limited capacity. (gov.uk)
People have limited attention. Security training has to earn some of it.
2. The Feeling That You’ve Learned Absolutely Nothing
Completing training and learning something are very different events.
A person can watch the videos, click through the slides, answer the questions and arrive triumphantly at “Training Complete” without acquiring much that will influence their next decision.
A 2026 study in Computers & Security surveyed 965 people in the UK and tested their knowledge of basic cyber security practices. Around half had received training from their current employer, yet only 8.6% correctly identified the relevant best practice across the study’s two measures. The researchers found that online training was associated with greater self-reported familiarity and confidence without a corresponding improvement in tested knowledge. (sciencedirect.com)
That’s an awkward finding for an industry that loves a completion percentage.
3. The Same Advice, Wearing a Different Hat
Password security. Phishing. MFA. Suspicious links. Sensitive information. Attachments.
The same subjects can appear year after year, often wrapped in slightly different designs and followed by another quiz.
Repetition has a place in learning, but repetition without meaningful variation can become background noise. Research into “cybersecurity advice fatigue” found that the characteristics of training content, including its style and design, contribute to people’s fatigue with security advice. (sciencedirect.com)
A finance team, a sales team and a software engineer can all encounter phishing, but the decisions they make and the situations they face can be very different. Generic training can quickly lose relevance.
4. The Annual Ceremony of Clicking Through Things
There’s a particular genre of workplace training where the main challenge is staying awake long enough to find the button. Click, next, next, next, accept, complete; eventually the screen announces that the training has been successfully finished.
The EDUCAUSE 2023 QuickPoll found that 61% of respondents considered their institution’s security awareness training only somewhat effective. Respondents also described training as boring, overly long or complicated, with outdated content and limited customisation among the challenges reported. (er.educause.edu)
If the most memorable thing about a security course is how quickly someone discovered the “skip” button, the course has probably missed an opportunity.
5. Feeling Like You’re Being Watched
Cyber security already has a slightly surveillance-shaped shadow hanging over it.
People know that security teams can see things. They know that systems generate logs. They know that phishing simulations can record whether someone clicked.
That can create an uncomfortable psychological shift, particularly when someone starts wondering whether security is there to help them make better decisions or catch them making bad ones.
Research into employee perceptions of security awareness training has found that people make inferences about an organisation’s motives and that these perceptions influence their receptivity to the content. (sciencedirect.com)
When security feels like surveillance, people can become more interested in avoiding scrutiny than seeking help. That’s an awkward outcome in a field that depends on people reporting suspicious activity quickly.
6. The Phishing Email That Could Have Been Sent by a Human
Phishing simulations are supposed to recreate the uncertainty of a real phishing attempt. Sometimes they recreate the unmistakable smell of a training exercise.
The message arrives at an oddly convenient time, the wording is strangely generic and the link feels suspicious from the first sentence. After enough exposure, people can become good at recognising the simulation itself.
Research into phishing training suggests that immediate, contextual feedback can be more useful than simply repeating the test. A 2025 randomised study involving more than 19,500 healthcare employees found that embedded training produced a statistically significant reduction in failure rates, although the absolute improvement was modest and engagement with the material was often brief.
The simulation is only part of the learning experience.
7. Training That Lives in 2021
Cyber threats move quickly, while training content can move at the speed of an annual review cycle.
AI-generated phishing, collaboration platforms, QR-code attacks, deepfakes and increasingly convincing impersonation techniques have changed the shape of the problem. People can still find themselves sitting through training built around examples they’ve seen for years.
EDUCAUSE respondents identified outdated training as one of the shortcomings of their programmes. (er.educause.edu)
If the security course looks like it was designed several technology cycles ago, enthusiasm probably isn’t going to improve.
8. The Security Team Says “People Are the Weakest Link”
Calling employees the “weakest link” might feel like a convenient description of human risk. It can also make people feel like the problem security needs to control.
Behavioural science offers a more useful starting point. People make decisions within systems, shaped by time pressure, workload, available information, interface design, organisational culture and the choices presented to them.
The UK Government’s cyber security research captures this reality in practical terms. One business described staff doing something because it was convenient; the organisation could see the risky behaviour, but convenience was part of the explanation. (gov.uk)
The useful questions are therefore quite simple: was the guidance available, was it relevant, did the person have time to process it, could they ask for help and did the secure option fit naturally into the way they worked?
So, what would people actually like?
This is where the list becomes slightly uncomfortable for the industry.
Most of the frustrations above point towards the same design challenge. People need security advice that respects their time, fits the work they’re actually doing and arrives while there’s still something useful to do with it.
That’s the thinking behind Redflags. Its approach puts learning closer to the moment of risk, using context, microlearning and real-time interventions to turn everyday security decisions into useful learning opportunities. Content can keep pace with emerging threats while the experience stays light enough to fit into the working day.
Someone clicks something suspicious and gets help while the situation is still fresh. They can understand what happened, adjust their behaviour and carry that knowledge into the next decision.
For the security team, the result is a richer picture of where people need support and where interventions are making a difference.
It’s a fairly simple premise: if cyber security has to live alongside people all day, it should feel like something designed with people in mind.
Key takeaways
-
People value their time. Training needs to earn the attention it takes.
-
Completion isn’t the same as learning. Finishing a module says little about what someone will do next.
-
Context beats generic advice. Guidance is more useful when it connects to a real decision.
-
Security can feel like surveillance. Helpful interventions can make it easier for people to seek support and report problems.
-
Repetition has limits. Familiar formats can quickly become background noise.
-
The future of awareness is more human. Short, contextual and timely interventions can make security part of everyday work.
