Why training does not reduce the risk (and what actually does)

Completing a course does not change behaviour. The real gap lies between knowing and acting when the time comes to make a choice. That is what really reduces human risk.

· 6 min

Every year, organisations invest in compulsory training. People watch the videos, pass the quizzes and receive their certificates. Completion rates rise. And the risk remains exactly where it was. This is not a paradox: it is a structural flaw in the way most companies deal with human risk.

The gap between knowledge and action

The problem isn’t that people don’t know what’s risky. Most people are well aware that they shouldn’t click on a suspicious link, share a password or skip a security check. The gap isn’t between those who know and those who don’t: it’s between knowing something in theory and acting differently in the heat of the moment, under pressure, whilst rushing to complete a task.

A completed course measures whether a person has viewed a piece of content. It does not measure whether their behaviour has changed.

Industry research confirms this. The real gap lies not in awareness, but in behaviour that persists despite that awareness. People complete the training and carry on doing the same things.

The risk is concentrated

There is one fact that changes the way we view the issue: a small proportion of people account for the vast majority of exposure. Not because they are acting in bad faith, but because they are more exposed, more distracted and more targeted. Training everyone in the same way, on the same content, ignores this concentration.

  • 68% of the breaches involve a human element (Verizon DBIR 2024)
  • 8% / 80% 8% of people account for 80% of incidents (Mimecast)

What really reduces the risk

There are three things that a course on its own cannot do: measure actual exposure (where the risk really lies, in which behaviours and among which people); practise the behaviour at the moment of decision-making rather than explaining it in the abstract; and demonstrate with data that the risk has fallen. Training simply fills your head with facts. Change only happens when behaviour is practised where it matters.

It is the difference between an organisation that can produce a record of completed training courses and one that can demonstrate that the measured risk has been reduced. The former has fulfilled its obligations. The latter has protected itself.