Why Annual Mandatory Security Training Falls Short: The Completion Rate Trap

Mandatory security training given once a year is not enough to change how employees behave during a real attack. An employee marked as "training complete" can click a phishing link the same day. The training itself is rarely the problem; measuring success by completion rate is. In this article we explain why the annual model falls short and what a continuous awareness programme does differently.

Losses grew while training grew too

According to the FBI's Internet Crime Complaint Center (IC3), reported cybercrime losses in the United States rose from about $4.2 billion in 2020 to $20.9 billion in 2025, roughly fivefold in five years. Over the same period most companies kept their annual security training, and many expanded it.

Both trends happening at once suggests something is off. The security community explains it in two ways:

• First view: the training is the issue. The content is weak, repetition is too low and measurement is missing. Done properly, the outcome would change.
• Second view: completion rate was never a security indicator. People do not start behaving differently because they finished a module.

Both views reach the same point: a once-a-year "click through and finish" course does not reduce human risk.

Why completion rates mislead

In many organisations success is measured with questions like these: how many people took the course? How many modules were opened? Who is top of the list?

The questions that matter often go unanswered:

• Did behaviour change?
• Did it affect how people make decisions?
• Did it show up in business outcomes?

Managers see a 100 percent completion rate and conclude the team is ready. Security teams see a different picture on the ground. A completion rate shows that someone played a video to the end. It says nothing about whether that person will spot a suspicious email on a tired Friday afternoon.

Gamification, microlearning, e-learning: when the tool becomes the goal

Learning and development teams have embraced gamification, microlearning and AI-generated content in recent years. None of these is wrong in itself. The trouble starts when the tool becomes the goal and replaces learning.

People tire of anything repetitive. Gamification works at first, then loses its effect. Handing everyone the same package, or producing more content, does not create behaviour change.

What a continuous awareness programme does differently

Forrester Research gave this approach a name: human risk management. Where the classic training model gives everyone the same content, it looks at each employee's actual behaviour.

An effective continuous programme usually includes:

1. Regular phishing simulations that measure how employees react to scenarios resembling a real attack.
2. Short, frequent training: a few minutes a month on current threats in place of a one-hour video once a year.
3. Role-based content: the risks an accountant faces are different from a software team's.
4. Easy reporting: flagging a suspicious email with one click.
5. Behavioural data: how metrics such as click rate, reporting rate and reporting time change over time.

What to measure

These metrics are more meaningful than completion rate:

• Reporting rate: the share of employees who spot and report a simulated email
• Time to report: how quickly the first report arrives
• Repeat mistakes: whether the same person fails the same type of scenario again
• Risk distribution: which departments or roles need more support

In Marsh McLennan's 2025 Cybersecurity Signals report, security awareness training and phishing tests ranked third out of 12 controls for their effect on reducing breach risk. One notable finding: the quality of training, meaning current content and realistic simulations, was linked to outcomes more than its frequency. Making that effect visible requires measurement that goes beyond completion rate.

Frequently asked questions

---
InfoLore's security culture programmes focus on behavioural data, with completion rate as only one signal. Get in touch to review your current programme together.