Risk Attitude vs Risk Behavior: Are You Training the Wrong Thing?

Fundamentally, conventional awareness programs (annual slide decks, quizzes, and generic phishing emails sent to all staff) often do not replicate the pressure and personalization of real attacks. They may raise knowledge levels, but they don’t reliably change behavior.

Humans are creatures of habit and context: if training is infrequent, not targeted, or too far from users’ daily reality, its lessons fade quickly. Factors like workplace stress, fatigue, or the perceived urgency of tasks can easily override the memory of a training module from months ago . This is especially true in high-stress environments (e.g. healthcare) where staff may know the rules but, amid constant pressure, revert to insecure practices that seem expedient.

Saying it simply, one cannot lecture or quiz their way out of phishing risk – new methods are needed to actually influence day-to-day user actions.

A New Approach: Personalized, Context-Aware Phishing Simulations in Combination With Customized E-learnings! 

Most phishing training still looks way different from real attacks. It’s generic, predictable, and easy to detect. But real threats? They’re personalized. They use names, roles, company context—whatever makes the message feel real.

Attackers often use publicly available information to craft these emails. So it makes sense that training should do the same. When a simulation feels believable, users react the way they would in real life – not the way they think they should in a quiz. Remember the cyber risk behavior right?

In light of these insights, new solutions are arriving to help organizations implement personalized phishing training at scale. For example, our OSINT Reconnaissance Module *** – a newly announced feature. It is designed to automate the generation of highly realistic phishing simulations using publicly available data. This kind of tool can continuously scour open sources to tailor fake phishing emails to each employee with the help of of our phish-email-automator (e.g. referencing a recent social media post or a public company announcement), operationalizing the research-backed principle that the more realistic and targeted the simulation, the more effective the learning outcome. By leveraging automation and intelligence, such a module allows security teams to run ongoing, adaptive phishing exercises without massive manual effort – an important factor for scaling and adoption of the cybersecurity awareness solution. The end goal is to create a self-improving “human firewall”: employees who not only know about phishing but have practiced their responses to the point of habit. 

*** The OSINT Reconnaissance Module is available as an experimental feature since Version 2.7.0. If you’d like to explore it further or activate it for your team, feel free to reach out or check the release notes in your dashboard.