Phishing isn't an awareness strategy: The behavioural science behind why your human risk program is broken
Behavioural science explains why annual training and phishing simulations rarely change behaviour, and what an evidence-based human risk program needs instead.
Session Details
Every year, Australian organisations tick the compliance box and call it an awareness program. Security teams run phishing simulations, assign annual training, and then when the same behaviours perpetuate, they're left wondering why nothing seems to stick.
But the answer is simple. Most awareness programs were never designed to change behaviour. They were designed to demonstrate activity.
This session draws on established behavioural science and cognitive psychology research, combined with years of experience designing and running security awareness programs inside some of Australia's most complex and highly regulated organisations, to explain exactly why traditional approaches fail, and what a program built around how humans actually think, learn, and behave looks like in practice.
What this session covers:
The first half dismantles the assumptions underlying most awareness programs. Attendees will understand why one-off training fails through the lens of the Ebbinghaus Forgetting Curve and spaced repetition research; why fear-based, compliance-driven content triggers avoidance rather than vigilance; why the intention-behaviour gap means employees who understand a threat will still make the same mistake under pressure; and why phishing simulations deployed without a broader culture strategy produce shame and distrust rather than genuine preparedness.
The second half introduces a behavioural science-informed framework for designing awareness programs that actually change how people think and act, built around five evidence-based principles:
- Relevance:why role-based, contextually specific content is not a nice-to-have, but the mechanism through which awareness becomes action.
- Frequency: the value of consistent, bite-sized and regular learning moments.
- Emotional engagement: how storytelling activates cognitive pathways required for learning.
- Culture:why organisations where leadership visibly models secure behaviour have different human risk profiles.
- Measurement: why click rates are not security metrics, and what to track instead.
The session closes with practical guidance for security professionals navigating the internal challenge of shifting awareness from a compliance function to a risk management capability, including how to build cross-functional support, make the business case for continuous investment, and get leadership genuinely engaged.
Who this is for:
Security professionals, GRC leaders, and CISOs who are responsible for workforce awareness programs and want an evidence-based framework for making them effective.
There's More Where This Came From
Browse hundreds of sessions and build an agenda around the topics that matter to you.
