TL;DR: Phishing simulations can create useful learning, especially when feedback arrives in context, but repeated testing can quickly produce diminishing returns; a people-centred approach puts learning at the moment of risk, where behaviour can actually change.
When Phishing Simulations Stop Teaching
Phishing simulations have become a familiar ritual in cyber security. An email arrives that looks as though it might be from a colleague, a supplier, a bank or a familiar service; someone clicks; a training page appears; a dashboard records the result.
The logic is easy to understand. If people are going to encounter phishing in their working lives, giving them an opportunity to recognise it in a safe environment should help them respond differently when the real thing arrives.
That idea has sound foundations in behavioural science. Some of the earliest research into embedded phishing education found that people could learn more effectively when education appeared during normal email use, immediately around the decision being made. Kumaraguru and colleagues’ work, published through the ACM’s CHI conference in 2007, helped establish the principle of learning in context: the suspicious message itself could become the teaching environment. (doi.org)
The difficulty begins when a useful learning mechanism becomes a repeated test.
A simulation was designed to create a teachable moment
The original attraction of phishing simulations wasn’t simply that they could measure who clicked. They offered an opportunity to connect behaviour with learning.
Someone receives a suspicious message and makes a decision. If they click, the organisation can immediately explain what happened and show them the cues they could have considered. The experience is fresh, the decision is still accessible in memory, and the lesson is connected to something the person has just done.
That’s very different from asking someone to complete a generic cyber security module six months before they encounter a particular threat.
Human behaviour is deeply dependent on context. NIST’s research into phishing has similarly emphasised the interaction between observable features of a message and the user’s context, including their role and what they’re being asked to do. (nist.gov)
A simulation can therefore create a realistic situation in which someone has to make a decision, with feedback turning that decision into a learning opportunity.
The question is what happens after that first useful experience.
The law of diminishing returns catches up
The law of diminishing returns is a simple idea. An intervention can produce a meaningful improvement when it’s first introduced, while each additional application produces a smaller gain. Eventually, the resources invested in repeating it can exceed the additional value it creates.
A first phishing simulation can expose someone to a technique they’ve never encountered, reveal how urgency or authority affects their judgement, and create an opportunity to discuss the decision.
A second exposure can reinforce the lesson.
A series of increasingly familiar simulations can begin to teach something else: the organisation regularly sends strange emails, there is usually a training page after a click, and the safest response during a simulation is to look for the clues the security team has taught them to expect.
At that point, the exercise can start measuring familiarity with the exercise itself.
Research involving almost 3 million simulated phishing emails across six US healthcare institutions found that repeated campaigns were associated with lower odds of clicking on subsequent simulations. The finding demonstrates that repeated exposure can change behaviour; it doesn’t, by itself, establish that the resulting improvement represents durable resilience against real-world phishing. (pubmed.ncbi.nlm.nih.gov)
More recent evidence makes the question harder to ignore. A large randomised controlled study by researchers at the University of California San Diego examined ten simulated phishing campaigns involving more than 19,500 healthcare employees over eight months. The researchers found no significant relationship between the recency of annual security training and failure on a simulation. Embedded training produced a statistically significant reduction in failure rates, but the absolute reduction was around two percentage points. More than half of embedded-training sessions ended within ten seconds, with fewer than a quarter of users formally completing the material. (sysnet.ucsd.edu)
These findings don’t show that phishing simulations have no value. They show how limited the practical effect of some commonly deployed approaches can be, particularly when engagement is low.
The useful life of a simulation may be surprisingly short
It’s tempting to think of security learning as something that accumulates each time a person completes another exercise.
Human learning rarely works quite so neatly.
A person can learn from an experience and then quickly become familiar with its format. A simulated email may initially prompt genuine scrutiny; after enough exposure, the person may simply recognise the pattern. The intervention has shifted from teaching someone how to think about a suspicious request towards teaching them how to pass a recurring security test.
So when does someone have the greatest capacity to learn from a particular behaviour?
Often, it’s very close to the moment of the decision.
Context changes the learning equation
Consider the difference between two experiences.
Someone completes a twenty-minute phishing module on a Tuesday morning. Three months later, they receive an email asking them to review an unexpected document.
Alternatively, they receive that document while they’re working, click the link, and immediately see a short explanation showing the feature of the message that should have prompted a second look.
The second experience has several behavioural advantages. The person has a live example in front of them. The decision is fresh. The explanation can refer to the actual request, sender and cues that were present. The learning has a direct connection to their work.
This is the basic idea behind contextual learning. When guidance appears alongside the behaviour that prompted it, people can understand why the intervention happened and apply what they’ve learned to the next decision.
It also changes the relationship between security and the people it’s trying to protect. Someone who makes a mistake becomes someone who has encountered an opportunity to learn; they’re not simply a data point in a monthly click-rate report.
This is increasingly reflected in the way people-centred security products are being designed. The Redflags approach, for example, centres security guidance around the decisions people are already making, bringing context and feedback closer to the point of risk. The technology can identify and intervene when something needs attention, while the experience remains part of the person’s working environment rather than a test administered from outside it.
Research continues to support the role of feedback and context. A 2026 study in the International Journal of Human-Computer Studies found that immediate feedback reduced phishing susceptibility, while also finding that participation and engagement influenced the training experience. (sciencedirect.com)
Recent work examining security education in organisations points in the same direction. A 2026 study of more than 12,000 user actions across three years in an Irish public-sector organisation examined how different security education, training and awareness interventions affected phishing behaviour, with a focus on how programmes can influence what people actually do. (research.ucc.ie)
Punishment can change behaviour, but it changes the relationship too
There is an understandable attraction to punishment in security. If someone knows that clicking a simulated phishing email could lead to a formal consequence, perhaps they’ll think twice.
There is evidence that deterrence can influence behaviour. A field experiment published in Behaviour & Information Technology found that punishment reduced repeat phishing failures among employees who were punished, while training also reduced susceptibility. (tandfonline.com)
Behavioural science asks a wider question than whether a behaviour can be suppressed. It also considers what happens around that behaviour.
Fear can influence a decision; it can also affect whether someone feels comfortable reporting a mistake, asking for help or admitting they’ve interacted with something suspicious. Someone who believes security is primarily concerned with catching them may become more concerned with avoiding blame than reporting an incident quickly.
A security culture needs people who can make good decisions, ask questions when they’re unsure and report problems quickly when something goes wrong. A punitive environment can introduce friction into all three behaviours.
The National Cyber Security Centre’s current cyber security culture principles take a similarly people-centred view. The NCSC describes behaviour as being shaped by factors including feelings, values, available time and effort, physical and mental capabilities, and people’s inclination to seek help. It also explicitly argues that simply providing more information eventually reaches a point of diminishing returns. (ncsc.gov.uk)
The sledgehammer needs to come off the desk
Phishing simulations still have a role. They can establish a baseline, explore particular scenarios and give security teams evidence about how people respond to different kinds of requests. They can also provide a useful learning experience when they’re designed around the person and the situation.
The difficulty comes when the simulation becomes the strategy, rather than one part of a broader learning environment.
Sending another simulated phish because the calendar says it’s time for another one is easy to administer. It also produces an attractive metric: click rates go up or down, dashboards fill with data and reports can be produced.
Behavioural change is harder to measure because it’s contextual and continuous.
Once the emphasis moves from the number of simulations delivered towards the quality of decisions being supported, the role of the simulation changes. It becomes one tool within a broader learning environment, alongside timely guidance, useful feedback, effective reporting mechanisms and interventions that respond to what someone is actually trying to do.
Security awareness should behave more like learning
People don’t become good drivers because somebody occasionally sends them a deceptive road sign and records whether they react correctly. They learn through instruction, practice, feedback, experience and repeated decisions in the environment in which driving actually happens.
Cyber security can be approached in much the same way.
A phishing simulation can be part of that learning system. It can introduce an unfamiliar scenario or help an organisation understand where additional support is needed. Its value starts to diminish when the simulation itself becomes the centre of the programme.
The evidence increasingly points towards the importance of timing, context, engagement, feedback and repetition in determining what people take away from a security intervention. (sysnet.ucsd.edu)
The first simulation may teach something important. The second may reinforce it. The tenth may still generate a useful metric while contributing little additional learning. The twentieth may primarily show that people have become familiar with the organisation’s training pattern.
There isn’t a universal number at which this happens; the useful life of a simulation will vary with the people, the scenario, the frequency, the quality of the feedback and the wider security environment.
It can, however, be much shorter than the programme around it assumes, particularly when repetition becomes more recognisable than the behaviour it’s intended to teach.
That leaves security teams with a more useful question: where are people making meaningful security decisions, and what support will help them make those decisions well? That support can include simulations, but it can also mean timely guidance, relevant feedback, accessible reporting routes and interventions that fit naturally into the work people are already doing.
The emerging people-centred approach represented by Redflags sits within that broader shift, treating security awareness as an ongoing part of the working environment rather than a series of tests that people periodically have to pass.
The opportunity is to give people the context to understand a risk, the feedback to adjust their behaviour and the confidence to ask for help when they’re unsure.
Key takeaways
-
Phishing simulations can teach effectively when they’re tied to a real decision and followed by immediate, relevant feedback.
-
Repeated simulations can produce diminishing returns, especially when people become familiar with the exercise or engage only briefly with the training.
-
Punishment can deter some behaviour, while a people-centred security culture also needs to support reporting, help-seeking and psychological safety.
-
Contextual learning brings security awareness closer to the moment when behaviour happens, giving people useful guidance while they can still act on it.
