Awareness Training is Aimed at the Wrong Person
Every October, the training module goes out. The steps are the same: Spot the suspicious link. Check the sender address before you click.
Meanwhile, the call that takes companies down goes to someone else. In May, the FBI warned about a crew posing as internal IT and calling US law firms, talking staff into opening a remote session. When the call failed, someone showed up at the office and asked to image a machine. Google's threat researchers tracked the same group through dozens of professional services firms between January and May. There was no exploit or malware. Only a phone call and a plausible reason to help.
That is the correction October's message needs: the person most likely to let an attacker in is not the careless clicker but the one whose job is to say yes.
What training does, and what it does not
The largest controlled test of security awareness training ran for eight months among 19,500 employees at UC San Diego Health. Annual training showed no significant effect on the share who fell for a simulated phishing email. Training that fires the moment someone clicks cut failures by about two percent. The bait moved the numbers. One lure drew clicks from 1.8 percent of recipients. Another, dressed up as a change to the vacation policy, drew 30.8 percent.
Scrap the training, and you lose something real. Habits matter, which is why the National Cybersecurity Alliance is right to focus on them in October. Even so, a module cannot fix a problem that was never a knowledge gap in the first place.
The attacker moved. The program did not.
Mandiant's M-Trends 2026 looked at a year of its own incident response work and found voice phishing had climbed to 11 percent of intrusions, making it the second most common way attackers got in. Email phishing had fallen to 6 percent. Exploited vulnerabilities still lead at 32 percent, but the channel most awareness programs are built around now sits behind the channel most of them ignore.
The Verizon 2026 Data Breach Investigations Report tells a similar story from a different dataset, with pretexting rising as an entry point for ransomware and extortion. CrowdStrike recorded twice as many vishing intrusions in the first half of 2026 as in the second half of 2025.
Voice isn't the biggest door by any means, but it is the least guarded. Verizon's own analysts say most programs don't use the right countermeasures: pretexting calls require business rules written for each exposed function, not a checklist for reading emails.
Most organizations haven't written those rules. They test the inbox every month and rarely test the phone. Verizon found voice and text simulations hard to measure because so few companies run them.
The helper is doing what you pay them to do
Here's the part no one says out loud at a security conference: The service desk agent who resets an executive's access at 7pm without a second check is not failing at their job. They are doing it well.
Consider what we measure in that seat: time to resolution, tickets closed, and satisfaction scores that rise when agents are accommodating. A locked-out vice president who cannot reach the board deck becomes both the attacker's script and the agent's performance review.
We cannot train someone out of the behavior we reward. Put a trained agent in that seat with a pressured caller on the line, and the incentive wins often enough to matter.
Three things that work better than another module
First, take the decision out of the hands of the person on the call. The FBI's guidance to firms under attack this year is to publish a policy on how IT will contact staff and verify identity. That is a rule, not an awareness message. Nobody talks their way around a rule that requires verification through a number already on file, every time, with no exceptions for seniority.
Second, name the executive who backs the refusal. Every rule like this gets tested by someone senior and in a hurry. If the agent who says no has to defend that answer alone, the rule is decorative. Decide now, in writing, who takes that call.
Third, test it the way it will be attacked. Run the voice scenario against the service desk, the front desk, and whoever answers the main line. The goal isn't to test whether they remember the training, but whether the rule holds when someone is pushing hard.
Two questions worth asking
This week, ask whoever runs your service desk what they are measured on. Then ask what happens to the agent who tells a vice president no.
If the first answer is speed and the second is nothing good, you don't have an awareness problem. You have a scoreboard problem. Awareness Month tests your people. That question tests you.
Frequently asked questions
Why does security awareness training fail against help desk social engineering?
Awareness training teaches employees to evaluate messages they receive. A service desk agent facing a caller is making a service decision under time pressure, which is a different task that recognition training does not address.
Who in an organization should receive social engineering training?
Anyone able to reset credentials, unlock an account, or grant access. In most mid-size companies, that means the service desk, the front desk, and whoever answers the main line, not general staff alone.
What actually stops voice-based social engineering?
Verification rules the person on the call cannot override, executive backing for staff who refuse a senior request, and live voice testing to confirm those rules hold under pressure.
Should companies stop running security awareness training?
No. Training builds habits worth having, and well-timed training does move behavior, if modestly. What it cannot do is close an exposure that was never a knowledge gap. Help desk social engineering is not a training problem; it is an incentive problem, and it has to be fixed there.
NopalCyber runs voice-based social engineering tests against service desks and front-line teams as part of its offensive security work. If you want to know whether your rule holds under pressure, get in touch.
Varun (Ira) Iravatham is the Chief Executive Officer of NopalCyber. He has more than 15 years of experience as a cybersecurity executive, including as Vice President and Chief Information Security Officer at QuisLex.
