{"id":35556,"date":"2025-10-14T14:08:38","date_gmt":"2025-10-14T14:08:38","guid":{"rendered":"https:\/\/grapenordic.com\/phishing-test-or-awareness-training-what-works-best\/"},"modified":"2026-10-04T17:57:53","modified_gmt":"2026-10-04T17:57:53","slug":"phishing-test-or-awareness-training-what-works-best","status":"publish","type":"post","link":"https:\/\/grapenordic.com\/en\/phishing-test-or-awareness-training-what-works-best\/","title":{"rendered":"Phishing test or awareness training? What works best?"},"content":{"rendered":"\n

Stands your organization across the street rising phishingthreats, human I at the same time struggling with that get employees to that Roof cyber security serious? You are not alone. Many ITsecurity managers is located sig i a dilemma Between that Drive phishing test and invest i thorough awareness-Training. <\/p>\n\n

Research shows that continuous, targeted IT security and awareness training outperforms one-off phishing tests when it comes to behavioral change, reporting culture and security awareness. According to a Report from Stanford University<\/a> 88% of data breaches are due to human error, highlighting the need for effective training. But what does this mean for your security strategy? And how can you avoid the negative side effects that many test-based approaches bring? <\/p>\n\n

In this article, we review the evidence behind both approaches and give you concrete recommendations to strengthen your organization\u2019s cyber security without creating guilt or stress among employees.<\/p>\n\n

Why phishing test <\/span>alone is not enough <\/span><\/h2>\n\n

Phishing tests may seem like the obvious solution. They are simple to implement, provide measurable results and seem immediately effective. But research reveals a more complex picture. <\/span> <\/span><\/p>\n\n

Verizon\u2019s Data Breach Investigations Report (DBIR) <\/a>consistently shows that phishing and pretexting are behind 44% of all social attacks. At the same time, the report highlights user training as a critical security control \u2013 not as a standalone test, but as an integral part of a broader security strategy. <\/span><\/p>\n\n

UK\u2019s National Cyber Security Center (NCSC)<\/a><\/b> states that phishing simulations should serve as learning tools rather than fear-inducing exams. Their guidance points out that test-based methods without follow-up training often lead to lower reporting rates and a blame culture. <\/span><\/p>\n\n

The hidden costs of testing cultures<\/span><\/b> <\/span><\/h3>\n\n

Improperly implemented phishing tests can do more harm than good. According to a Survey from Tessian<\/a> 43% of employees feel stressed or embarrassed when they fail a phishing test. Research documents that this approach can lead to: <\/span><\/p>\n\n