Because I work as a consultant, I periodically have to take some company’s mandatory security test before they’ll let me touch their systems.
I’m a security guy. I’ve spent decades in this field. And I sit there for an hour or two playing whatever gamified module their compliance vendor sold them: shoot here and learn a fact, click there and collect a badge.
I understand the intent. Someone decided training was tedious, so they made it a game, hoping fun would carry the content. What they built is tedium with graphics. I’ve never heard users say anything good about these modules, and the structural problem is worse than the aesthetics: you can retake the quiz until you pass. Get a question wrong, try another answer, try another, done. Nothing about that loop requires learning anything. It requires persistence, and it produces a compliance record, and that’s the real product.
The training exists so the company can say training occurred.
My friend Sixto Bernal built his whole philosophy on one idea: cybersecurity is the opposite of a cost center.
Executives book it as money spent and gone, when it pays back far more than it costs by preventing breaches, preventing lawsuits, and protecting the company’s reputation. Not every company he worked with bought the argument, and I think most executives miss it because they don’t understand security well enough to see the return. The replayable module is what you get from the ones who miss it, the cheapest available proof that training happened.
What security training model works?
Contrast that with the approach KnowBe4 built its business on. Users get real training about phishing and safe computing. Then, unannounced, they get tested with actual simulated phishing emails arriving in their actual inboxes on ordinary days.
Click one, and you’re routed back for more training. No badges, no target practice. A live test of the exact behavior that gets companies breached, with a feedback loop attached to the people who need it.
The difference is what’s being measured. Gamified modules measure quiz completion. Phishing simulation measures whether a person, on a normal Tuesday, believing the email is real, clicks. Only the second number has anything to do with your breach risk, and I say that as someone whose own layered defenses once had to catch a phish that fooled me personally, a fake UPS notice timed five minutes after a real order. The click is human. The question is whether your training addresses the click or the checkbox.
What number matters in security training?
The deep difference between the two training models is that only one produces a number. A completion-based program yields a completion rate, which measures administrative throughput and nothing else; every company that mandates the modules achieves roughly one hundred percent, eventually, and learns nothing from it.
A simulation-based program yields a click rate: what fraction of your people, on an ordinary day, believing the phish was real, clicked. That number has properties completion rates lack.
It’s a baseline, it moves in response to training, it varies by department in ways that tell you where your risk concentrates, and it corresponds to the actual event, the click, that begins most real breaches.
I get irritated when a security team presents a completion rate to the board as a measure of safety. All it tells the board is that the vendor’s software ran. A click rate tells them how many employees would have opened the door to an attacker last month, and that’s the number a CEO should be losing sleep over.
Once the number exists, security awareness stops being a belief and becomes a program you can manage.
I get irritated when a security team presents a completion rate to the board as a measure of safety.
You can watch it fall as training lands, watch it spike when a cleverly themed simulation defeats a department, and target the retraining where the clicks are instead of carpet-bombing the whole company annually. Nothing about that is exotic. It’s the same measure-and-iterate loop every other business function runs, applied to the human layer, and the strange thing is how recently that became normal in security.
Completion rates measure paperwork. Click rates measure breaches. Only one of those numbers is about security.Share on X
What did Richard Lowe do on Cyberheist?
My view of KnowBe4 comes from the inside. Stu Sjouwerman, the company’s founder, wrote Cyberheist, a book about phishing and the business of cybercrime. When it went obsolete, he brought me in to update it, and years later he brought me back for a near rewrite: the 2020 edition, roughly three hundred pages, which KnowBe4 still offers for download. The credits list me as contributing author and technical editor, alongside Roger A. Grimes. Stu has since sold the company for a fortune he earned, and I wouldn’t mind doing the same.
Rewriting a security book twice, years apart, teaches you something about the field: the technology in the first edition ages into obsolescence, and the human chapters barely need touching. Phishing in the rewrite was phishing in the original with better grammar and worse consequences.
That’s the entire case for training that targets behavior. The attacks that persist are the ones aimed at people, so the training that matters is the kind that measurably changes what people do.
When somebody clicks, the bill lands on other people too: customers whose records walk out the door, coworkers who spend weeks rebuilding systems, and the employee who clicked, who gets blamed for missing an email nobody ever taught them to spot. I think blaming that employee is unfair. The fault belongs to the program that handed them a badge and called them trained.
My take
Measure the click rate and ignore the completion rate. A replay-until-you-pass game proves the vendor’s software ran, and that’s all it proves. Send realistic phishing, retrain the people who click, and target the departments where the clicks cluster. Watch the number fall. When somebody does click, blame the program that called them trained. The attacks aimed at people barely change over the years, so behavior training is the training worth paying for.
What should executives learn about security awareness training?
If your security training is a module with a replay button, you’ve purchased evidence instead of defense. Ask your team two questions: what percentage of our staff clicks a simulated phish, and is that number falling? If nobody can answer, the training program has no instrument attached, and an unmeasured program is indistinguishable from no program. The vendors who can answer exist. I helped write their book.
For more from this series, see The Cybersecurity Hub: breaches, audits, and hard-won security lessons from four decades in the trenches.
Security training belongs at home as well as at work. My book Family Cybersecurity starts with a friend who clicked an ordinary attachment and lost her photos, then shows how to protect everyone in your house.
