The Security Awareness Paradox: Is Human Training Still a Viable Defense in the Age of AI?

For years, security awareness training has been the bedrock of enterprise cybersecurity strategy. Almost every organization mandates that its workforce undergo annual modules designed to transform employees into a "human firewall." Yet, as cyberattacks continue to scale in both sophistication and frequency, a growing chorus of experts is questioning whether this investment produces tangible security outcomes or merely creates a false sense of safety.

The empirical reality is sobering: while companies continue to invest heavily in training, successful social engineering attacks are on the rise. Opinions on the efficacy of these programs remain polarized, ranging from outright dismissal of their utility to a more nuanced view that effectiveness depends entirely on execution. At its core, the objective of such training is twofold: to mitigate the risk of insider threats stemming from poor judgment and to harden the workforce against malicious social engineering. As the threat landscape shifts toward AI-driven manipulation, the latter goal has become the focal point of a heated industry debate.

The Pitfalls of Compliance Theater

A prevailing sentiment among security professionals is that while awareness training is fundamentally necessary, it is frequently sabotaged by the way it is implemented. Stefan Dasic, a senior malware research engineer at Malwarebytes, argues that the failure of many programs lies in their delivery. He describes them as repetitive, generic, and ultimately uninspiring, which leads employees to view the process as a hollow obligation rather than an educational experience.

This systemic issue is often exacerbated by external pressures. "Some of that repetition isn’t just poor design—a lot of it is driven by compliance and insurance requirements that mandate the same content be re-delivered to every employee every year, regardless of whether they already know it," Dasic explains. When training is reduced to a recurring legal checkbox, its protective value evaporates.

Robert Costello, chief digital and information officer at Merlin Group, echoes this concern, noting that the content of modern training programs rarely keeps pace with the current reality. "Too much of today’s training is compliance-focused and doesn’t reflect the sophisticated social engineering and AI-enabled attacks organizations face today," he notes.

Mike Lyman, a senior security consultant at Black Duck, takes this criticism further, characterizing the phenomenon as "compliance theater." He points out that requiring employees to retake identical courses across multiple employers is a prime example of a process that prioritizes completion metrics over actual behavioral change. This disconnect may explain why academic studies often find weak or null effects even in organizations with near-perfect training completion rates. The central problem with compliance-mandated training is that it establishes a low bar for completion rather than a baseline for continuous improvement.

Adapting to an Evolving Threat Landscape

If traditional training is failing, what is the alternative? Drew Thompson, global lead for training and enablement at UltraViolet Cyber, suggests that training can work, but it is often misaligned with the speed of modern threats. "The attackers keep changing what they are doing, and the training is often trying to prepare people based on what we already know," Thompson says.

This sentiment is shared by Josh Bartolomie, VP and global head of threat intelligence at Doppel. He notes that while awareness remains essential, many organizations are laboring under the expectation that training can solve a problem that has fundamentally evolved. Both Thompson and Bartolomie advocate for more frequent, role-based training that evolves alongside emerging threats and emphasizes behavioral reactions to suspicious communications.

Crucially, experts agree that training can no longer be the primary line of defense. "Security awareness training still has a role; however, it should reinforce a modern security architecture, not compensate for the lack of one," Costello asserts. Biswajit De, co-founder and CTO at CleanStart, agrees, suggesting that awareness must complement robust engineering. "Good engineering assumes things will fail, and good security should assume people occasionally will too," De adds.

The urgency of this shift is being driven by the rise of generative AI. Jim Dolce, CEO at Lookout, believes that the concept of the "human firewall" is a relic of a desktop-centric era. Today, Frontier AI enables the weaponization of social engineering, generating hyper-personalized phishing attempts and voice clones that operate at machine speed across mobile channels like SMS and WhatsApp. "Security awareness training fails because we are asking humans to defeat AI on a 6-inch phone screen," Dolce argues. "You cannot train away a structural architectural problem."

Mike Aalto, co-founder and CEO at Hoxhunt, highlights the scale of this shift, noting a 14-fold surge in AI-generated phishing between 2025 and 2026. He argues that while the core tactics of phishing—such as urgency and authority—remain the same, they are being modernized with superior formatting, impeccable writing, and extreme personalization. Aalto advocates for "behavioral" training that moves away from fear-based tactics. By rewarding core behaviors like threat reporting and the use of multi-factor authentication, organizations can foster a culture where employees function as an "active, intelligent human sensor network."

The Psychology of Memory and Decision-Making

To understand why traditional training often fails to stick, it is necessary to look at cognitive psychology. Jordan Richard Schoenherr, a scientist at Humanix and an adjunct professor at the University of New South Wales, emphasizes that "forgetting—or entropy—is the default state of memory."

For training to be effective, it must move information into long-term memory and then facilitate the correct behavioral response when a threat appears. This is a difficult cognitive feat. If an employee is trained only to look for the "classic" red flags of old-school phishing, such as spelling errors or poor grammar, they may mistakenly assume that a polished, AI-generated message is legitimate. As Schoenherr notes, the absence of proof is not proof of absence.

Predicting the future of these attacks is equally challenging. "When we give people creative tasks, it activates the prefrontal cortex for executive functions," Schoenherr explains, describing how the brain constructs mental models to predict future events. While humans can be effective at predicting short-term trends, these mental models break down when new, unforeseen variables are introduced.

Schoenherr suggests that organizations must move toward "decision-making under deep uncertainty." This approach involves developing multiple potential scenarios based on known variables and running simulations to determine the most effective outcomes. It is an imperfect, demanding process, but it is far more realistic than expecting employees to maintain constant vigilance against a constantly shifting threat.

The Asymmetry of Modern Defense

The fundamental disadvantage in the battle against social engineering is asymmetry. As Biswajit De notes, defenders must be right every time, while attackers only need to succeed once. This is the core of the cybersecurity struggle: requiring a human to be perpetually perfect against thousands of AI-assisted, high-speed threats.

Despite the skepticism surrounding current methods, the industry is not abandoning training. Instead, the consensus is moving toward a model where training is frequent, context-aware, and supported by advanced technical controls. Sanny Liao, co-founder and CPO at Fable Security, suggests that the industry should look to adtech for inspiration. Marketers have mastered the art of delivering the right message at the right time based on user context. If security training could be integrated into the actual workflow—delivering guidance at the precise moment a decision is being made—it might finally move from being a source of annoyance to a source of genuine protection.

Ultimately, while the psychology of cognition cannot eliminate the inherent asymmetry of social engineering, it can provide a blueprint for better training methodologies. By combining behavioral conditioning, frequent reinforcement, and a robust, modern security architecture, organizations can move closer to a state of resilience. As De aptly puts it, expecting security awareness training alone to stop cyberattacks is like expecting airport security posters to prevent hijackings—it is a piece of the puzzle, but it is never, by itself, the solution.