Security Awareness Training

Threat Context

Insights from

Most organisations train staff once a year^1,2. A 20-minute module, a completion-rate report filed for audit. They satisfy a regulatory checkbox. But they do not change behaviour.³

It's been true since 1885. Forgetting Ebbinghaus' Curve,⁴ or countless studies telling us infrequent training only produces a minimal change in behaviour. Closer to home, an Adelaide study found that where training improved phishing identification, improvement had disappeared by 6 months.⁵

The Australian Information Commissioner recorded 1,113 notifiable data breaches in 2024 (the highest annual total since the NDB scheme began).⁶

Human factors, including phishing, credential theft, and social engineering, were implicated in approximately 45% of all incidents.⁷ The skills gap between staff and attackers is widening.

Training can't teach beyond the inbox

Tekspace's Email Security research supports email as the dominant vector in AU breach data.⁸

But the attack surface grew beyond the inbox and programs do not train the gap. Voice phishing surged fourfold in the past year⁹, yet only one in five orgs train staff for phone-based attacks¹⁰. SMS phishing had more than doubled¹¹, with similarly thin training coverage. And virtually no training assesses the established QR code phishing vector.

AI shifts the balance further. By early 2025, AI-generated phishing outperformed human-crafted attacks by approximately 24%¹². It was estimated 80% of phishing in that period was AI-generated¹³ The attacks are more convincing and produced at a scale no human team could sustain.

The deepfake dimension compounds the risk. Mastercard-commissioned research found 20% of Australian businesses received deepfake threats in the prior 12 months¹⁴, but many of the trusted training software vendors have no plan to offer deepfake capability in the next 6 months.¹⁵

For organisations responsible for customer data, not training staff to identify emerging vectors indicates training does not satisfy the regulatory requirements for cyber awareness outlined by The OAIC's APP 11: Security of personal information.

The regulatory cost of inadequate training

In 2025, the Federal Court handed down the first civil penalty ever issued under the Privacy Act for a data breach: $5.8 million against Australian Clinical Labs¹⁶. The court specifically noted that “the IT team leader had no formal cybersecurity training and had never seen the organisation's cyber playbooks”.

In 2024, an enforceable undertaking against Oxfam Australia became the first to explicitly mandate a security awareness training program.¹⁷

For the first time ever, cybersecurity training is now a business obligation, not an IT task. When a breach happens, businesses face a greater financial cost from the government than the APTs.

Across the regulated economy, the bar for adequate training has moved from completion to demonstrated behaviour change.

Product Landscape

Security awareness training is a well-defined category with a clear set of capabilities.

The Tekspace Cyber Continuum™ ranks 20 of the leading security awareness training vendors in one transparent, measureable spectrum.

We assessed 300+ vendor features across the field, normalising to 39 distinct capabilities. A weighted scoring model produces a single maturity score per vendor, giving a picture of feature depth rather than feature count alone.

Addendum

Credits

In launching this report, the Tekspace would like to acknowledge contributions from the following teams and individuals.

References

1. Australian Signals Directorate (2025), ASD Annual Report 2024-25
2. Australian Signals Directorate (2025), ASD Annual Report 2024-25
3. Australian Federal Police (2025), Criminals target construction sector with Business Email Compromise scams
4. Australian Signals Directorate (2025), Annual Cyber Threat Report 2024-25: fact sheet for businesses and organisations
5. Practice Protect AU (2025), The devil is still in the email: what BEC looks like in 2025.
6. Riposte Cybersecurity Consultancy (2025) Phishing threats in Australia's legal sector
7. SecurityBrief Australia (2025) Email attacks surge in APAC, phishing up by 30% in 2024
8. Australian Signals Directorate (2025), ASD Annual Report 2024-25.
9. Australian Institute of Criminality (2024), Cybercrime in Australia 2023-24
10. DeepStrike (2025), AI cybersecurity threats 2025: how to survive the AI arms race
11. Keepnet Labs (2024), Navigating the email security market in 2025
12. Abnormal Security (2024), H1 2024 Phishing Frenzy: C-suite receives 42x more QR code attacks than average employee
13. Integris (2025) 2025 Integris report: law firms, cybersecurity and AI - what clients really think
14. Google Threat Intelligence Group, Mandiant & Google Security Operations, (2025) Cybersecurity Forecast 2026
15. VIPRE Security Group (2025) Cyber threats in 2025: how AI is changing phishing tactics
16. StrongestLayer (2025) StrongestLayer secures US$5.2M to combat emerging AI-driven email threats
17. Australian Institute of Criminality (2024), Cybercrime in Australia 2023-24

Scope

This report evaluates platforms delivering phishing simulations, in-email reporting, and cybersecurity awareness education. It does not cover standalone email security gateways, broader governance/risk/compliance platforms, or physical security awareness programs.

Twenty-three vendors were researched. Three were excluded as out-of-category following technical review, leaving 20 platforms in the final evaluation.

Scoring Methodology

One hundred and forty-four enriched features were normalised into 32 canonical capabilities across 20 evaluated vendors. Each capability was classified into one of three maturity bands based on how many vendors offer it.

Tablestakes capabilities (offered by 13 or more vendors) represent market baseline. Common capabilities (5-12 vendors) represent meaningful differentiation. Advanced capabilities (4 or fewer vendors) represent specialist depth.

A weighted scoring model assigns higher value to capabilities requiring greater technical depth, producing a single maturity score per vendor.

Feature Granuality Model

At the outset, we aimed to produce an analysis that is both strategic and practical. It needs to be useful to all IT leaders, regardless of how familiar they are with a given product domain.

In doing so, we gave consideration to how products are compared against one another.

Comparison at a superficial level is too shallow and doesn't give insight as to differentiation between products. At the same time, diving into technical minutiae can often mean losing focus of how products are meaningfully differnt.

As such, we conduct our evaluation at what we call, Level 2: The Functional Group.

In doing so, we can consistently assess whether a product's capabilities are more or less likely to help IT leaders achieve their desired outcomes.

Disclaimers

Where commercial relationships exist, we apply the same evaluation criteria we use for all technologies, including tools we do not resell. We recognise the importance of independence in this research, and do not let commercial relationships affect our framework.

Findings reflect our professional judgement at the time of publication, based on the data available to us. Product capabilities and roadmaps change, so organisations should treat this report as a guide to practical decision making, not as a substitute for their own due diligence.

If you have identified errors in this report, or wish to have another product assessed, please contact our team.