Still clicking: Why a billion-dollar industry hasn't moved the dial, and what actually has to change

Employees who complete mandatory phishing training are 18.5% more likely to fall for a phish after each session. Not less likely. More. That is the conclusion of a 2025 randomised controlled trial across nearly 20,000 employees. We have been spending billions to make the problem worse.

And it is accelerating. Phishing is the entry point in 60% of Australian cyber incidents. Business email compromise is the number one reported cybercrime for business. Large business costs rose 219% in a single year.

Phishing succeeds not because people are careless, but because it exploits how every brain works under pressure: authority bias, loss aversion, time pressure. Static training does not address this. Between 37 and 51% of sessions have zero engagement. Knowledge evaporates within 15 days. We run annual programmes. The maths has never worked.

The model was built for a threat that no longer exists. Today, attacks arrive 24 hours a day across email, SMS, voice calls, social media, and AI-generated deepfakes. NCSC UK, ENISA, and NIST have each said this in published guidance. The industry has not caught up. 

The market structure guarantees it. The phishing training industry is built on annual renewal contracts where success is measured by completion rates and simulated click statistics. Metrics the vendor sets, runs, and reports. When trained employees become more trusting of suspicious communications, no renewal conversation surfaces it. A compliance market produces compliance products.

Australia's Scams Prevention Framework 2025 requires reasonable steps to prevent scams. A once-yearly module does not meet that bar. 

The session moves in three acts. Act one presents the evidence on why training fails, using live audience polling to surface assumptions in the room. Act two examines the structural and cognitive reasons the model cannot fix itself. Act three sets out what the research supports, illustrated by three case studies showing outcomes at scale. Delegates leave with a one-page evidence brief, a framework for evaluating their current approach, and three specific actions they can take on Monday morning. 

The results at scale are clear. A global logistics organisation of 44,000 employees achieved an 86% reduction in phishing click rates. A government transport agency reduced rates from 26.7% to 10.9%. A professional services firm of 11,000 people recorded an 84% reduction alongside measurable gains in detection confidence.

This is not a passive session. Delivered as a provocative, data-led talk with audience challenges built in, delegates leave ready to challenge the model, not just reconsider it.

"Makes concepts transition from theoretical to pragmatic."​(Coles Group) 

"Rated the most engaging and practically useful session of the entire event."​ (AICWA)

The compliance model was built for a different era. The threat has moved. The question is whether we are willing to move with it.