Security Training ROI for Phishing Prevention

Security awareness training is often sold with a simple promise: fewer clicks, fewer breaches, and a large return. The evidence is more mixed than that pitch suggests. A business case that will survive scrutiny from a CFO or board has to use your own numbers, state its assumptions, and measure the outcomes training demonstrably improves.

The stakes are real. IBM and the Ponemon Institute’s Cost of a Data Breach Report 2026 puts the global average cost of a data breach at a record $4.99 million. But phishing is not the only way in, or even the main one: Verizon’s 2026 Data Breach Investigations Report, covering incidents from November 2024 through October 2025, found that exploitation of software vulnerabilities was the top entry point, at 31% of breaches, ahead of stolen credentials. Training addresses one part of the risk.

What the Evidence Says About Training

Vendor Benchmarks

KnowBe4’s 2026 Phishing by Industry Benchmarking Report, drawn from millions of simulated phishing tests, puts the average baseline Phish-prone Percentage at 33.2% and reports that organizations training continuously for a year bring it down to 4.2%, an average reduction of 87%. These are results on simulated phishing among the vendor’s customers; the report page does not explain how the figure is calculated or whether it is compared against an untrained group.

Independent Controlled Studies

Randomized studies inside real organizations find much smaller effects:

UC San Diego Health (2025): Ho et al., presented at the IEEE Symposium on Security and Privacy, ran an eight-month randomized controlled experiment with ten simulated campaigns sent to more than 19,500 employees. They found no significant relationship between recently completing annual awareness training and failing a simulation. Embedded training lowered failure rates by only 1.7 percentage points on average. Over half of training sessions ended within 10 seconds, fewer than 24% of users completed the material, and over 56% of users clicked a phishing link at some point during the study.
A 15-month study of 14,000+ employees: Lain, Kostiainen, and Čapkun (IEEE S&P 2022) found that embedded training during simulated phishing “does not make employees more resilient” and can have side effects that make them more susceptible. They also showed that employees reporting suspicious mail through a report button worked as a fast, practical detection mechanism for new campaigns.
A 2025 reproduction study: Rozema and Davis tested 12,511 employees at a US financial technology firm and found no significant effect of training on click rates or reporting rates. Lure difficulty mattered more: click rates rose from 7.0% for easy lures to 15.0% for hard ones.

The honest reading: simulated click rates can fall in vendor programs, but controlled studies find small or no effects from training as commonly deployed, and click rates swing with lure difficulty. An ROI model that treats an 87% drop in simulated clicks as an 87% drop in breach risk is not supported.

A Defensible ROI Framework

Step 1: Estimate the Cost of a Phishing-Initiated Incident

Start with your own incident history, insurance claims data, and size. IBM’s $4.99 million average spans all industries, sizes, and breach types, so treat it as a reference point rather than a default. Include response, legal, notification, downtime, and direct fraud losses such as business email compromise wire transfers.

Step 2: Estimate How Often It Happens

Probability is the variable most training pitches leave out. Multiplying an average breach cost by the share of breaches that start with phishing gives the phishing share of one breach, not an annual figure. You need an annual likelihood, drawn from your own incident and near-miss data or from insurer and peer data. Annual loss expectancy (ALE) is the cost per incident multiplied by the expected number of incidents per year.

Step 3: Estimate the Program’s Effect Conservatively

Do not map simulated click-rate reductions directly onto breach probability. Use a range: a low case close to the small effects in the controlled studies, and a high case based on your own measured change against a comparison group.

Step 4: Count the Full Cost

Platform licenses for training and phishing simulations
Program administration time
Employee time: number of employees × training hours per year × loaded hourly cost
Security team time to triage user reports

Step 5: Calculate Return on Security Investment

Return on security investment (ROSI) = (reduction in ALE − annual program cost) ÷ annual program cost.

A hypothetical example shows why assumptions matter. A 1,000-person company estimates that a phishing-initiated incident would cost $1.5 million and puts the chance of one in a given year at 10%, for an ALE of $150,000. Its program costs $60,000 a year, including employee time. If training and reporting cut the annual likelihood by 20%, the benefit is $30,000 and ROSI is −50%. If they cut it by half, the benefit is $75,000 and ROSI is +25%. The result depends almost entirely on the effect size, which is why measurement matters more than any benchmark.

Returns Beyond Breach Reduction

Compliance Requirements

For many organizations, training is mandatory, so part of its cost is the price of compliance rather than a discretionary bet:

HIPAA Security Rule (healthcare): a security awareness and training program for all workforce members, including management (45 CFR 164.308(a)(5))
FTC Safeguards Rule under GLBA (financial services): “security awareness training that is updated as necessary to reflect risks identified by the risk assessment” (16 CFR 314.4(e))
NYDFS Part 500: “periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel” (23 NYCRR 500.14)
NIST Cybersecurity Framework 2.0, a framework rather than a regulation, includes awareness and training for all personnel (PR.AT-01) and for specialized roles (PR.AT-02) (NIST CSWP 29)

Faster Reporting and Detection

The best-supported return from awareness programs is reporting. When one employee reports a phishing email quickly, the security team can remove it from every other inbox before more people click. Lain and colleagues showed that crowd-sourced reporting detects new campaigns quickly at an acceptable operational load. Rozema and Davis found that in 36% to 55% of campaigns the first reports arrived before the first clicks, although training did not significantly improve that. Invest in an easy report button and fast triage; see our incident response guide.

Metrics That Show Real Value

Leading Indicators

Reporting rate and time to first report: the most actionable measures
Click and credential-submission rates, normalized for lure difficulty: NIST’s Phish Scale rates how hard a lure is to detect (NIST notes commercial use requires a license)
Training engagement: completion and time spent, not just assignments sent

Lagging Indicators

Real phishing incidents reaching users
Accounts compromised through phishing
Direct financial losses and incident response costs

Measure Against a Control Group

Ho and colleagues found that some lures drew clicks from 1-2% of users and others from more than 30%, a swing far larger than the training effect. Without a comparison group, a falling click rate may only mean easier simulations. Hold out a small randomized group or, at minimum, compare results on lures of similar difficulty.

Maximizing Training Value

Favor Interactive, Short Content

In the UC San Diego Health study, interactive training reduced the likelihood of clicking a later lure by 19% among users who completed it, while static training pages were not associated with improvement. The absolute effect was small because so few users completed training, so design for completion: short, interactive, and relevant to the lure.

Role-Based Scenarios

Target simulations to role-specific risks, and let employees who consistently spot basic lures graduate to harder spear phishing scenarios:

Finance staff: BEC, wire transfer fraud, invoice manipulation
HR staff: W-2 requests, employee data harvesting
Executives: whaling, confidential data requests
IT staff: credential harvesting, system access requests
All staff: brand impersonation, smishing, QR code phishing

Pair Training With Technical Controls

Because most users will eventually click something (over 56% did in the UC San Diego Health study), training cannot be the main barrier. Phishing-resistant MFA, email filtering, and zero trust limit the damage of a click. Use simulation data to prioritize those controls for high-risk roles and departments.

Key Takeaways

Vendor benchmarks report large drops in simulated click rates (KnowBe4 2026: 33.2% to 4.2%), but randomized studies find small or no effects from training as commonly deployed (UC San Diego Health: failure rates 1.7 percentage points lower)
A credible ROI model multiplies incident cost by annual likelihood and uses conservative, measured effect sizes
HIPAA, the FTC Safeguards Rule, and NYDFS Part 500 require training, so part of its cost is compliance
Reporting speed is the best-supported return; measure it and make reporting easy
Normalize results for lure difficulty and compare against a control group
Pair training with phishing-resistant MFA and filtering rather than relying on users alone

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

This content is for educational purposes only. Actual ROI varies with organization size, sector, baseline risk, and program design.