What causes security awareness training fatigue?

Security training fatigue is real, and it has more than one cause. Researchers at the U.S. National Institute of Standards and Technology (NIST) found that people asked to make constant security decisions and heed constant warnings start to tune them out. Inside a training program, two causes are within the security team’s direct control: how much training employees receive and whether it feels relevant to their work.

Relevance is also the part we can measure. After every course, Nimblr asks employees one question: how relevant was this to you? Across 364,531 ratings, 62% said fully relevant, 32% moderately relevant and 5.8% not relevant. Those ratings measure relevance rather than fatigue, and this post explains what that difference means for CISOs and HR leaders planning a program.

What causes security awareness training fatigue?

Training fatigue is the point where employees stop paying attention to security training. They click through slides to reach the end, skip the optional parts and treat each new course as one more task in a full inbox. Admins usually notice it as falling completion rates, rising reminder counts and comments that the training “is always the same.”

It helps to separate the causes, because each one calls for a different fix. The most common are volume, when employees feel they receive too much training or too many security messages in general; repetition, when the same topics return without anything new to learn; and distance, when the content doesn’t match the person’s role, tools or daily risks.

Volume gets most of the attention, and it deserves some. In the NIST interviews, many participants described feeling overwhelmed by warnings, passwords and updates, and that weariness led to resignation and risky shortcuts.

Cutting frequency can help when a program sends long modules every few weeks. It does little for repetition or distance, though, and it gives employees fewer chances to practice spotting real attacks. A program can send less training and still feel irrelevant to the people who receive it.

Why is relevance important in security awareness training?

Relevance decides whether a lesson earns attention. A short lesson on a threat an employee saw last week is easy to finish and easy to remember. A 45-minute module on topics that don’t apply to their job feels long even if it only comes once a year.

Training research points the same way. The Kirkpatrick model, one of the most widely used frameworks for evaluating training, measures how participants react to a course through satisfaction, engagement and relevance. Of the three, Kirkpatrick Partners’ current guidance treats relevance as the best early sign that people will apply what they learned on the job. Someone can enjoy a course and never use it, while a course that fits their work gives them something to do differently the next day.

The opposite shows up in research, too. In an eight-month study of 19,500 employees at UC San Diego Health, most employees spent a minute or less on the training shown after they clicked a simulated phishing link, and a third closed it without engaging at all. Training that people skip can’t change much, however well it’s built.

Relevance also works at the level of the individual. A payroll specialist needs to recognize invoice and payment fraud. A developer needs to know how attackers target code repositories and access tokens. When both receive the same course, at least one of them is likely to find it less useful. That’s why Nimblr’s security awareness training uses lessons under five minutes, in more than 30 languages, matched to each employee’s role and current threats.

What do 364,531 employee ratings reveal about security awareness training?

Every Nimblr course ends with the same question, and employees answer on a scale of 1 (not relevant), 5 (moderately relevant) or 10 (fully relevant). Across 364,531 ratings from 6,590 organizations, 94% rated the course moderately or fully relevant. The answers split like this:

More than six in 10 ratings were the highest possible score. The result isn’t driven by a handful of enthusiastic customers. Among the 2,930 organizations with 20 or more ratings, 99.5% had at least eight in 10 ratings at moderately or fully relevant. It also holds across organization size. The share of top ratings stays between 60% and 65% from small teams to large organizations, and “not relevant” ratings stay between 5% and 7%.

The topics employees rate highest are the threats they meet at work every day. Ransomware leads with 72.6% top ratings, followed by Teams phishing at 67.7% and phishing through email and web pages at 67.4%. Courses built on familiar tools and real attacks, like the scenarios in our [phishing simulations](LINK: phishing simulations page), tend to feel most useful to the people taking them.

For a fatigue discussion, the smallest number is the most telling. Only 5.8% of ratings called a course not relevant. Distance from the job is one of the most common reasons people give for tuning out, so that’s a meaningful signal, even though it isn’t a fatigue score.

What the ratings don’t measure

The ratings measure how relevant a course felt to the employee who answered. We think it’s worth being clear about the limits before drawing conclusions:

• They don’t measure fatigue directly. An employee can find each course relevant and still feel they receive too many reminders, and the question doesn’t ask about volume or timing.
• They don’t measure learning or behavior. Relevance is an early signal, and behavior has to be measured separately.
• Ratings aren’t people. One employee can rate several courses, so 364,531 ratings come from fewer individuals than that.
• The base leans toward engaged employees. People who choose to answer are probably more engaged than those who skip the question, so the results likely lean positive.
• Base content on current attacks. Training built on real attack data stays close to what lands in inboxes and on phones this month, and timely topics such as holiday scams keep the program from feeling static.
• Match training to roles. Finance, HR, IT and frontline teams face different risks. Role-Based Learning sends courses to the people they were written for, so specialist topics reach the employees who need them.
• Teach in the moment. When an employee clicks a simulated attack, Instant Learning delivers immediate feedback and a short lesson tied to what they just experienced.
• Read the answers.A single relevance question after each course gives a steady signal at low cost. Where “not relevant” ratings rise for a topic or team, check first whether the course reached the right people, and only then change the content.
• Keep the wider security load in mind. Fewer, clearer rules and a simple way to report a suspicious message reduce the number of decisions employees have to make, which is what the NIST researchers recommend as a response to fatigue.

To see whether training changes behavior, look at what employees do when a simulated attack arrives. Across Nimblr customers, organizations see an 80% average reduction in clicked simulations within three months, and Awareness Level reporting shows where risk sits and how it changes over time. Relevance tells you whether the training fits, and behavior data tells you whether it works.

How can you keep security awareness training relevant over time?

Keeping training relevant is ongoing work, because threats, tools and roles all change. These practices help CISOs and HR leaders keep content close to what employees face:

Where boosters and repetition fit

Repetition is necessary for lasting behavior, and it causes fatigue only when it feels like the same lesson again. A study presented at the USENIX Symposium on Usable Privacy and Security (SOUPS) found that what employees learned about phishing faded over the following months, and recommended refreshing it after about six months.

Boosters help here. A booster is a short follow-up that revisits a topic some time after the main course, often from a new angle or with a fresh example. It reinforces the key action, such as checking a sender or reporting a suspicious message, without asking the employee to sit through the full course again.

Repetition works best when it responds to what the employee does. Someone who clicks a simulated CEO fraud email has shown a real gap, so a short lesson right away is relevant almost by definition. Someone who consistently reports simulations needs less of the basics and benefits more from harder scenarios.

Compliance topics are a special case. Many organizations need employees to revisit an acceptable use policy or NIS2 awareness every year, and Nimblr helps organizations meet those requirements. Short, focused versions keep those yearly rounds from feeling like a repeat of last year’s slides.

For a deeper look at why knowing the rules isn’t enough on its own, watch our webinar Why knowledge isn’t enough to change security behavior.

Frequently asked questions

Is security training fatigue real?

Yes. Employees do tune out security training, especially when it’s long, repetitive or unrelated to their job, and when it adds to a heavy load of other security demands.

What causes security training fatigue?

Too many security messages and decisions, long annual modules, topics that repeat without adding anything new and content that doesn’t match the employee’s role or daily tools.

Do employees find security awareness training relevant?

Most who rate Nimblr courses do. Across 364,531 ratings, 94% rated the course moderately or fully relevant, and 5.8% rated it not relevant.

How often should employees receive security training?

Short, regular lessons tend to work better than one long yearly session, and research on phishing training suggests refreshing it at least every six months.

Does relevance mean the training changes behavior?

No. Relevance shows how training feels and is an early sign that people will use it. Simulation results show what it does, and Nimblr customers see an 80% average reduction in clicked simulations within three months.

If you want to see how your own employees rate their training, book a 30-minute demo.

NIST: a study by NIST researchers found that the more people have to make computer security decisions and are prompted to be on alert, the more they experience decision fatigue, which leads to security fatigue. Their remedies included limiting the number of security decisions users need to make and making it simple for users to choose the right security action. beckershospitalreviewdlt

Kirkpatrick: Kirkpatrick Partners’ current guidance is that relevancy is the Level 1 measure that best indicates whether application and transfer will occur. Link to Kirkpatrick Partners directly, not to the secondary write-up. devlinpeck

UC San Diego: 75% of users engaged with the embedded training materials for a minute or less, and one-third immediately closed the training page without engaging at all. ucsd

USENIX SOUPS: phishing awareness training is forgotten over time, and employees need to be retrained after six months. Link to the original paper, not the blog summary I found. securityboulevard