What the research actually says
The evidence is genuinely mixed. Researchers have published large studies questioning whether annual or click-based phishing training changes behavior in a meaningful way. Others have found improvement when training is short, delivered close to the moment it's needed and focused on reporting. Results depend heavily on how the training is designed and measured.
We'd rather tell you that than promise a result nobody can promise.
It comes down to repetition, and management has to lead
One of our clients told us that a training episode they took that month is the reason they stopped an attack. We think that's typical of what works: short, regular training that people actually remember when a suspicious message shows up.
Most employees aren't tech people, and they don't love being trained on security. That's exactly why it has to happen regularly. Once a year isn't enough, because people forget. Repetition is what builds the habit. A box checked to say "training done" doesn't.
It also only works if management takes it seriously. When leaders complete the training, talk about it, and make reporting a suspicious message feel normal, employees follow. When it's treated as a chore, they will too.
At Blue Tree Technology®, every plan includes cyber training, and we build our plans around what cyber insurance requires.
What training can realistically do
- Teach people what to report and how. A fast report from one person can protect everyone else who received the same message.
- Build the habit of slowing down on payment changes, urgent requests and unexpected login prompts.
- Explain your own procedures, such as how to verify a wire request or what to do after clicking a link.
- Meet a requirement. Some insurers, clients and regulations ask for training and records that it happened. See what training cyber insurance requires.
What training can't do
- It won't make people immune to a convincing message on a busy day.
- It can't replace MFA, email filtering, endpoint protection or backups.
- It doesn't help if reporting a mistake feels like getting someone in trouble.
How to make it worth the time
- Keep it short and frequent rather than one long annual session.
- Make it specific to your firm: real examples of invoice fraud, fake shared-document links and payment requests your staff could actually receive.
- Measure reporting, not just clicks. How quickly do people report a suspicious message?
- Don't shame people. Someone who clicks and reports right away has done the most important part.
- Connect training to procedures. People should know exactly what happens after they report a phishing email.
The controls that matter when training fails
Assume someone will eventually click. These limit the damage:
- MFA on email and remote access, ideally phishing-resistant options such as passkeys or security keys for high-risk accounts.
- Email filtering and quarantine. See should you release a quarantined email?
- A verification procedure for payment changes that doesn't rely on email.
- Monitored endpoint protection and backups whose completion is verified.
FAQ
Are phishing simulations a good idea?
They can be useful as practice and to show where coaching is needed. They backfire if they feel like a gotcha or if failures are punished.
How often should we train?
Short, regular sessions work much better than a single annual one. Repetition is what matters. Check what your insurer or clients require.
If training doesn't fully work, should we skip it?
No. Do it well, keep it short and make sure the technical controls are there for when it isn't enough.
Still have a question?
Ask Little Sprout for general information. To talk about a training approach that fits your team, schedule a free 15-minute discovery call.