Security Awareness Training

Product Landscape

This is a crowded category: we screened more than 70 vendors offering some level of training. We’ve ranked the 20 platforms that deliver phishing simulation, in-email reporting and awareness education on the Tekspace Landscape to show what makes the top platforms so effective for buyers.

Threat Context

Insights from

Many organisations still train staff once a year¹: a short module, filed for audit. It satisfies the checkbox. It does not change behaviour. A 2025 study of more than 19,500 health workers found that staff who had recently completed their training were no less likely to fail a phishing test than staff who hadn't.²

A University of Adelaide review of 42 phishing-training studies found gains lasted six months at most. Brief refreshers stretched that to 12.³

Phishing was how attackers got in for 38% of the incidents reported to the ACSC in 2024-25.⁴ The skills gap between staff and attackers keeps widening. AI widens the gap further. Hoxhunt’s research found AI-written phishing is now 24% more effective than phishing written by people. In 2023 it was 31% less effective.⁵

The awareness-action gap

Before training, Australian and New Zealand staff click phishing tests at the third highest rate of any region in the world.⁶ Knowledge-based training alone can't close the gap between knowing and doing. In Proofpoint's 2024 survey, 72% of Australian workers admitted to a risky action at work, and 98% of them knew it was risky and did it anyway.⁷

Legacy modules can inform, but they can't change behaviour under pressure, deadline, or the authority cues modern social engineering exploits.

Training can’t teach beyond the inbox. Tekspace’s Email Security research found phishing is the single biggest cause of cyber breaches reported to the OAIC.⁸ But the attack surface has moved past the inbox, and training hasn't followed.

Deepfakes compound the risk: Mastercard-commissioned research found one in five Australian businesses had received a deepfake threat in the previous 12 months,⁹ yet only 4 of the 20 training platforms we assessed can simulate a deepfake of your own people.

The regulatory cost of inadequate training

Across the regulated economy, the bar for adequate training has moved from completion to demonstrated behaviour change. For the first time ever, cybersecurity training is now a business obligation, not an IT task. When a breach happens, businesses face a greater financial cost from the government than the APTs.

Addendum

Credits

In launching this report, the Tekspace would like to acknowledge contributions from the following teams and individuals.