GITNUXREPORT 2025

Security Awareness Training Statistics

Security awareness training reduces breaches, phishing clicks, and human error significantly.

Jannik Linder

Co-Founder of Gitnux, specialized in content and tech since 2016.

First published: April 29, 2025

Our Commitment to Accuracy

Rigorous fact-checking • Reputable sources • Regular updatesLearn more

Statistic 1

Organizations that conduct regular security awareness training have 50% fewer security incidents

Statistic 2

Only 13% of organizations conduct security awareness training for all employees

Statistic 3

Employees forget 75% of security awareness training content within a week

Statistic 4

54% of organizations do not provide any security training for new employees

Statistic 5

Workers trained in security are 70% less likely to fall victim to phishing scams

Statistic 6

80% of organizations believe security awareness training has reduced security incidents

Statistic 7

60% of employees rely on phishing simulation results to measure security awareness

Statistic 8

39% of organizations see a decrease in security incidents after implementing security awareness training

Statistic 9

Regular security training reduces the likelihood of a successful cyber attack by up to 60%

Statistic 10

62% of companies say their employees lack adequate security training

Statistic 11

78% of organizations find phishing simulations effective for raising awareness

Statistic 12

Only 29% of employees take security awareness training seriously

Statistic 13

Security awareness training can lead to a 50% reduction in security violations

Statistic 14

56% of cybersecurity professionals believe employee training impacts threat detection

Statistic 15

33% of employees report malicious emails to their IT departments after training, compared to 13% beforehand

Statistic 16

67% of company executives believe security awareness training is essential, yet only 45% provide ongoing training

Statistic 17

Companies that include security awareness training see a 30% improvement in reporting suspicious activity

Statistic 18

54% of respondents feel unprepared to handle a cyber attack, indicating a need for better training

Statistic 19

68% of organizations schedule security awareness training annually, but only 40% enforce it strictly

Statistic 20

59% of employees believe phishing simulations are a useful training tool, yet only 36% receive them regularly

Statistic 21

80% of cybersecurity professionals agree that security awareness training impacts overall security posture

Statistic 22

44% of organizations do not assess the effectiveness of their security awareness training, leading to ineffective programs

Statistic 23

66% of employees say they are more cautious about security after training, leading to fewer risky behaviors

Statistic 24

53% of companies incorporate gamification into their training to increase engagement, with 40% seeing positive results

Statistic 25

29% of organizations provide security training at onboarding, but only 12% do follow-up training, indicating a drop-off

Statistic 26

69% of employees cite lack of training as the main reason for falling victim to scams

Statistic 27

65% of organizations plan to increase their cybersecurity training budgets in the next year, showing growing awareness of its importance

Statistic 28

83% of cyber professionals believe ongoing training is vital, yet only 52% provide continuous learning opportunities

Statistic 29

Organizations with comprehensive security awareness programs report 35% fewer breaches

Statistic 30

75% of employees state that cybersecurity training increases their confidence in identifying threats

Statistic 31

70% of employees do not recognize a sophisticated phishing attempt

Statistic 32

95% of cybersecurity breaches are due to human error

Statistic 33

60% of employees admit to clicking on links or attachments in phishing tests

Statistic 34

85% of data breaches involve a human element

Statistic 35

SMEs are 2.5 times more likely to experience business disruption from cyber incidents when lacking security training

Statistic 36

47% of employees do not report suspected phishing emails because they fear repercussions

Statistic 37

90% of security breaches are caused by human error which can be mitigated by training

Statistic 38

The average cost of a security breach is $4.24 million, with human error accounting for most breaches

Statistic 39

87% of recent data breaches involved a human element which could be mitigated by regular training

Statistic 40

49% of employees in large organizations fail security assessments due to poor phishing recognition

Statistic 41

The average time to contain a data breach is 280 days, often due to human error delays

Statistic 42

78% of security breaches could be prevented with proper employee training, according to cybersecurity experts

Statistic 43

Phishing attacks increased by 65% during the COVID-19 pandemic

Statistic 44

Better security posture reduces breach costs by an average of 35%, making awareness training a cost-effective strategy

Statistic 45

The global cost of cybercrime is estimated to reach $8 trillion annually by 2023, emphasizing the need for employee training

Statistic 46

Security awareness training participation rates are higher in companies with formal policies, at 70%, versus 45% in informal ones

Slide 1 of 46

Sources

Our Reports have been cited by:

Trust Badges - Publications that have cited our reports

Key Highlights

70% of employees do not recognize a sophisticated phishing attempt
Organizations that conduct regular security awareness training have 50% fewer security incidents
95% of cybersecurity breaches are due to human error
60% of employees admit to clicking on links or attachments in phishing tests
Phishing attacks increased by 65% during the COVID-19 pandemic
Only 13% of organizations conduct security awareness training for all employees
Employees forget 75% of security awareness training content within a week
85% of data breaches involve a human element
54% of organizations do not provide any security training for new employees
Workers trained in security are 70% less likely to fall victim to phishing scams
80% of organizations believe security awareness training has reduced security incidents
60% of employees rely on phishing simulation results to measure security awareness
39% of organizations see a decrease in security incidents after implementing security awareness training

Did you know that while 95% of cybersecurity breaches stem from human error, only 13% of organizations provide comprehensive security awareness training to all employees, making effective training more crucial than ever in defending against the rising tide of cyber threats?

Employee Awareness and Training Effectiveness

Organizations that conduct regular security awareness training have 50% fewer security incidents
Only 13% of organizations conduct security awareness training for all employees
Employees forget 75% of security awareness training content within a week
54% of organizations do not provide any security training for new employees
Workers trained in security are 70% less likely to fall victim to phishing scams
80% of organizations believe security awareness training has reduced security incidents
60% of employees rely on phishing simulation results to measure security awareness
39% of organizations see a decrease in security incidents after implementing security awareness training
Regular security training reduces the likelihood of a successful cyber attack by up to 60%
62% of companies say their employees lack adequate security training
78% of organizations find phishing simulations effective for raising awareness
Only 29% of employees take security awareness training seriously
Security awareness training can lead to a 50% reduction in security violations
56% of cybersecurity professionals believe employee training impacts threat detection
33% of employees report malicious emails to their IT departments after training, compared to 13% beforehand
67% of company executives believe security awareness training is essential, yet only 45% provide ongoing training
Companies that include security awareness training see a 30% improvement in reporting suspicious activity
54% of respondents feel unprepared to handle a cyber attack, indicating a need for better training
68% of organizations schedule security awareness training annually, but only 40% enforce it strictly
59% of employees believe phishing simulations are a useful training tool, yet only 36% receive them regularly
80% of cybersecurity professionals agree that security awareness training impacts overall security posture
44% of organizations do not assess the effectiveness of their security awareness training, leading to ineffective programs
66% of employees say they are more cautious about security after training, leading to fewer risky behaviors
53% of companies incorporate gamification into their training to increase engagement, with 40% seeing positive results
29% of organizations provide security training at onboarding, but only 12% do follow-up training, indicating a drop-off
69% of employees cite lack of training as the main reason for falling victim to scams
65% of organizations plan to increase their cybersecurity training budgets in the next year, showing growing awareness of its importance
83% of cyber professionals believe ongoing training is vital, yet only 52% provide continuous learning opportunities
Organizations with comprehensive security awareness programs report 35% fewer breaches
75% of employees state that cybersecurity training increases their confidence in identifying threats

Employee Awareness and Training Effectiveness Interpretation

While over 80% of organizations recognize that security awareness training reduces incidents and boosts threat detection, the unsettling truth remains: only a fraction consistently engage their entire workforce with effective, ongoing education—highlighting that neglecting employee preparedness is the weakest link in cybersecurity defense.

Human Factors in Security Breaches

70% of employees do not recognize a sophisticated phishing attempt
95% of cybersecurity breaches are due to human error
60% of employees admit to clicking on links or attachments in phishing tests
85% of data breaches involve a human element
SMEs are 2.5 times more likely to experience business disruption from cyber incidents when lacking security training
47% of employees do not report suspected phishing emails because they fear repercussions
90% of security breaches are caused by human error which can be mitigated by training
The average cost of a security breach is $4.24 million, with human error accounting for most breaches
87% of recent data breaches involved a human element which could be mitigated by regular training
49% of employees in large organizations fail security assessments due to poor phishing recognition
The average time to contain a data breach is 280 days, often due to human error delays
78% of security breaches could be prevented with proper employee training, according to cybersecurity experts

Human Factors in Security Breaches Interpretation

Despite alarming statistics indicating that over 70% of employees fail to recognize sophisticated phishing, human error causes 95% of breaches and costs organizations millions, underscoring that comprehensive security training isn't just advisable—it's essential to turn the human element from the weakest link into a formidable line of defense.

Impact and Cost of Cybersecurity Incidents

Phishing attacks increased by 65% during the COVID-19 pandemic
Better security posture reduces breach costs by an average of 35%, making awareness training a cost-effective strategy
The global cost of cybercrime is estimated to reach $8 trillion annually by 2023, emphasizing the need for employee training

Impact and Cost of Cybersecurity Incidents Interpretation

As cybercriminals capitalize on pandemic-fueled vulnerabilities, investing in security awareness training isn't just wise—it's essential—since it can cut breach costs by 35% and help stem the staggering $8 trillion tide of global cybercrime on the horizon.

Organizational Security Practices and Policies

Security awareness training participation rates are higher in companies with formal policies, at 70%, versus 45% in informal ones

Organizational Security Practices and Policies Interpretation

Companies with formal security policies exponentially boost employee participation in awareness training—reminding us that a well-structured plan is the best defense against cyber threats.