Security Awareness Training That Employees Don't Hate

Employees don't hate security. They hate training that wastes their time and treats them like suspects. Security awareness training people don't hate is short, worth watching on its own merits, told through stories and humor instead of fear, free of trick-and-punish simulations, and built to show people that their reports of suspicious email actually matter.

The complaint is not boredom

Picture the annual module. Forty-five minutes, a narrator who sounds like a hostage, a quiz that asks whether you should share your password with a stranger. Everyone passes. Nobody remembers it by lunch.

Most advice says "make it fun." Fun helps, but it misreads the problem.

In 2009, Microsoft researcher Cormac Herley argued that ignoring security advice is often economically rational. Following every rule costs real time, every day, while the harm prevented for that one person is small and rare. The math often says "skip it."

A year earlier, Beautement, Sasse and Wonham described a compliance budget. Each person has a limited amount of effort they will spend on security tasks. Every password rule, every pop-up, every 45-minute annual module draws from the same account. When it runs dry, people find workarounds.

So the employee who drags the video slider to the end isn't lazy. They are protecting a budget you keep spending for them.

Information alone was never the product

Bada, Sasse and Nurse found in 2015 that awareness efforts fail when they only provide information. Knowing what phishing is does not mean you will notice it at 4:50 on a Friday.

Ho and colleagues (2025) found that recently completing annual training had no significant link to failing simulations, and most people spent minimal time on the training pages at all. Meanwhile, a 2023 study by NIST researchers found that US government programs lean on compliance metrics like completion rates.

So a 100% completion rate mostly proves people know where the "Next" button is.

Who tells the story matters more than the facts

Rick Wash and Molly Cooper (2018) found facts-and-advice training only beat no training when a security expert delivered it. Story-based training worked much better when a peer told it.

A short scene where a coworker almost wires money to a fake vendor sticks. A slide of seven warning signs does not.

Fear is the other default, and it's a weak one. Angela Sasse said it in a paper title: "Scaring and bullying people into security won't work." A tired person skimming an inbox at 4:50 isn't short on fear. Lain and colleagues (2024) concluded phishing looks more like an attention problem than a knowledge problem. You can't scare someone into paying attention for a year. You can make them want to watch the next episode.

Short and frequent beats long and thorough

Training gains fade. Reinheimer et al. found them gone by six months, and video reminders were the best at bringing them back. A few minutes a month, in a format that keeps changing, spends less of the compliance budget and does more than one heroic annual module.

Stop the trick-and-punish loop

This is where programs earn the hate. Someone clicks a simulated phish, lands on a "You failed!" page, and gets auto-enrolled in remedial training. Brian Krebs once asked in a 2019 headline whether failing should be a fireable offense.

The evidence does not support that loop. Lain et al. (IEEE S&P 2022, 14,000+ employees over 15 months) found that training shown right after a failed simulation did not improve resilience and could increase susceptibility. At a university hospital, Tolsdorf et al. (2025) saw some staff react to simulations with fear, shame, guilt and hostility.

Treat clicks as learning moments for everyone. Yin et al. (MIS Quarterly 2026) found that sharing feedback with all employees after a simulation looks more promising than feedback for clickers only.

Make reporting the thing people are proud of

Burda et al. (2025) found the top reason is wanting to protect the organization and their coworkers. Feed that motive.

It also works. Rozema and Davis (WWW '26, 12,511 employees) found that in 36% to 55% of simulations, a report arrived before the first click. That is why we track Suspicious Email Reporting Rate (SERR) as the main number, and why the race to report matters more than the click rate. Thank people when they report. Tell them what their report stopped.

Others doing this well

This isn't one vendor's idea. Wizer does short, plain videos. Hoxhunt is known for gamified simulations. Living Security leans into interactive formats. Any of them beats the hostage-narrator module.

How to tell in a demo whether your people will hate it

• Would you watch one of the videos voluntarily, with no completion tracking?
• How long is the longest required module? Past a few minutes, it drains the compliance budget.
• What does an employee see the moment after they click a simulation? Look for shame language like "You failed."
• Does the content blame the employee, or explain the trick and move on?
• Is reporting one button, and does the reporter get a thank-you or a result?
• What is the main dashboard metric? If it is completion rate, ask how they measure behavior.
• How often does the format change? Same template every month invites tuning out.

Where Hook fits

Hook Security is a security awareness training and phishing simulation platform built for MSPs and SMBs. Our training is humor-first micro-learning from Hook Studios: short videos people tend to watch because they're funny, not because a reminder email nagged them. Autopilot runs training and simulations automatically each month, and SERR is the number we put first. More than 250,000 employees train with Hook every month.

FAQ

What security awareness training do employees actually like?

Short, story-driven video with humor, a few minutes at a time. Wash and Cooper (2018) found stories told by a peer worked much better than a list of facts and advice.

Why do employees hate security awareness training?

Usually because it costs time without clear value and treats them as suspects. Herley (2009) showed ignoring security advice is often a rational choice when the cost outweighs the personal benefit.

Should employees be punished for clicking a phishing simulation?

The evidence says no. Lain et al. (2022) found training forced on people right after a click did not improve resilience and could make them more susceptible.

How long should security awareness training be?

Short and frequent. Reinheimer et al. (2020) found gains faded by six months, and Lain et al. (2024) found the regular reminder did most of the work, so short, regular lessons are a better bet than one long annual course.