1. “Awareness trainings simply shift responsibility onto users!”
Responsibility for IT security has always rested, at least in part, with end users. It should come as no surprise that IT security does not end at the door of the IT team—it is even a matter for leadership. Moreover, “human error” is almost never the true cause, but rather a symptom of a systemic problem. The root cause of a security incident is therefore not “Employee X clicked on a malicious link.” That is merely the initial trigger. No one makes a poor decision intentionally; every decision is shaped by the system in which it is made. Put simply: if no one guides employees, mistakes are inevitable.
Additionally, if a single measure—such as an awareness training—is all that stands between safety and disaster, something is fundamentally wrong. It would be just as misguided to dismiss technical measures like a firewall as useless simply because they cannot prevent everything on their own. Every IT security measure only works effectively in combination with others.
2. “If we run a phishing simulation, our employees will feel deceived. We don’t want that!”
The goal of any training should be that participants take something genuinely useful away from it. And that should certainly not be the feeling of having been tricked by their employer. What matters is how users learn about the test. Trainings must always be free of fear. Communicating this properly is the responsibility of HR departments and management. The principle of a fear-free environment must be reflected in everyday work and the company culture as well—so that employees feel safe reporting real incidents or mistakes rather than hiding them.
3. “These trainings aren’t practical at all!”
A poorly designed training is indeed impractical. Equally unrealistic, however, is the expectation that a one-day course once a year, capped with a multiple-choice test, meaningfully increases security. Eight hours of lecture-style “pure knowledge transfer” cannot achieve this. Most of it is forgotten soon after.
A training program that is designed for long-term impact and follows modern educational standards can absolutely be practical and effective. Regular repetition, short learning units, and real-world examples are essential, as is actively involving participants. Traditional lecture-style formats, with only senders and receivers, are pedagogically outdated. They may be efficient, but not particularly effective, because everyone learns differently. Interactive learning—ideally tied to the familiar work environment—yields the best results.
4. “We don’t want employees to feel ashamed of poor performance. That’s not how learning works!”
Again, the structure of the training and how the company handles results are key. The goal of an awareness campaign must never be to punish employees or publicly shame them. A training program should be designed so that participants enjoy engaging with it, while learning content is repeated regularly without becoming monotonous. Positive reinforcement—without constant finger-pointing—is crucial. Only then will information truly stick. Gamified approaches have proven successful in practice.
5. “No one can examine every single email in detail. There’s simply no time for that!”
That’s true. The goal is not for employees to take five minutes per email to inspect links, verify senders, or seek advice from others. That would be counterproductive. Rather, the goal is for employees to gradually develop a sense of when something about a message seems off. Naturally, this process isn’t flawless. Humans aren’t binary and don’t switch from “inexperienced” to “experienced” overnight. Serious training programs take this into account. What matters is measurable improvement between the start and end of the program—for example, after twelve months.
Ultimately, long-term strategy is the key to successful awareness training. Even seasoned professionals with years or decades of experience are not 100% immune to clicking the wrong thing. Those who only want to check off the “employee training” box in a compliance report may manage with a one-time lecture. But those who aim to meaningfully improve security in the long run must plan ahead and consider the specific needs of their organization. Security awareness is a core building block of IT security—just like patch management or data backups. It is a continuous process, not a one-off action. People can learn the correct behaviors—for example, how to respond properly to a potential phishing email and report it—but this requires time and especially practice. This cannot be achieved in two mornings a year, but it can be done in 10–15 minutes every few days, when the moment is right.
6. “But there’s even a scientific study saying that awareness trainings are a waste of time and money!”
That’s true. Some studies show that awareness trainings have limited value because the learning content is no longer present in everyday life after just a few weeks. However, these studies are based on a type of awareness training that is didactically outdated. They refer to “annual” awareness trainings—typically lecture-based content followed by a multiple-choice test. Research teams have convincingly demonstrated that such formats do not deliver long-term, sustainable results.
At least one of these studies acknowledges that its findings do not account for other forms of knowledge transfer. It does not rule out the success of alternative teaching methods. G DATA’s awareness trainings rely on short learning units repeated at shorter intervals. Interactive and playful elements play a key role in conveying the necessary knowledge, as does the long-term design of the overall learning program.
The blanket claim that awareness trainings are useless and a waste of time and money is therefore not valid, as it takes the findings out of context.
