Train employees on the channels attackers actually use, not just email. The 2026 Verizon Data Breach Investigations Report found the human element in 62 percent of breaches, and phone and text lures now succeed roughly 40 percent more often than email. Most security training still only covers the inbox, which is the easiest test to pass.
Key Takeaways
- The human element appeared in 62 percent of breaches in the 2026 Verizon DBIR, up from 60 percent the year before. A decade of awareness training has not moved this number down.
- Phone and text-based lures beat email. Voice and SMS simulations see roughly a 2 percent click rate versus about 1.4 percent for email.
- Email-only training grades the easy test. If your program never simulates a callback scam or a fake IT support call, you are not measuring your real exposure.
- Vulnerability exploitation is now the top initial access vector at 31 percent, so patching is a training issue too, not just an IT chore.
- 45 percent of employees now use AI tools on company devices, up from 15 percent a year earlier. Most policies have not caught up.
Why does employee security training matter?
Because people remain the way in. The 2026 Verizon Data Breach Investigations Report analyzed more than 22,000 confirmed breaches and found the human element present in 62 percent of them, up from 60 percent the previous year.
That number is the uncomfortable part. It has not fallen despite a decade of mandatory training modules and simulated phishing campaigns. Whatever most companies are doing is not working, and doing more of it harder is not the answer.
Small businesses are not too small to matter. Attackers do not pick targets by prestige. They pick by whoever answers the phone and does what the caller asks.
Why is email-only security training no longer enough?
Because attackers left the inbox and your training did not. The 2026 DBIR found that 41 percent of social engineering breaches used a vector other than email. Phone calls, text messages, QR codes, and chat platforms now carry a large share of the attacks.
Worse, those channels work better. Median click rates in voice and text simulations run near 2 percent, against roughly 1.4 percent for email. People are more trusting on the phone, more distracted on mobile, and less likely to pause on a text than on an email that looks slightly wrong.
An email-only program grades the test your staff are most likely to pass. It produces a reassuring completion report and leaves the channel that actually breaches you untested.
What attacks should your training actually cover?
Six patterns, and only the first is email. If your program stops after phishing, it covers roughly a third of the ground.
- Phishing. The email you already train for. Still 16 percent of initial access, still worth covering.
- Vishing. A live voice call, often impersonating IT or a vendor. Pretexting accounts for about 6 percent of initial access and is rising.
- Smishing. A text message with a link or a request to call a number back.
- Callback scams. An email with no link at all, just a phone number and a fake invoice. It sails past every link scanner you own.
- ClickFix. A fake CAPTCHA or error page that asks the user to paste a command into a terminal. The user installs the malware personally.
- Help desk impersonation. Someone calls your help desk claiming to be a locked-out employee and asks for a password reset.
Note what these have in common. Most of them defeat technical controls entirely, because a human being voluntarily opens the door.
How do you actually train employees on security?
Give people a procedure, not a warning. Telling staff to be vigilant puts the burden on their judgment in the exact moment an attacker has engineered to cloud it. A rule they can follow under pressure works better.
- Establish a callback rule. Any request for money, credentials, or data gets verified on a number your staff already has, never the one in the message.
- Make reporting fast and blameless. If reporting takes six clicks and an apology, nobody reports.
- Run simulations on voice and text, not just email. You cannot measure a channel you never test.
- Train the help desk separately. They are the ones being asked to reset passwords for strangers.
- Keep sessions short and frequent. An annual hour-long module is a compliance artifact, not a behavior change.
- Write down what to do in the first hour of a suspected breach, before you need it.
The callback rule is the highest-leverage item on that list. It defeats vishing, callback scams, and help desk impersonation with one habit, and it costs nothing to implement.
Should you punish employees who fail a phishing test?
No. Punishment teaches people to hide mistakes, which is the opposite of what you need. The value of a security program lives almost entirely in how fast someone tells you they clicked the thing.
An employee who clicks and reports it in two minutes hands you a containable incident. An employee who clicks and says nothing because they are afraid of being named in a report hands you a breach that gets discovered in week three.
Measure reporting speed, not just click rate. A team with a slightly higher click rate and a ten-minute median reporting time is safer than a team that clicks less and stays quiet.
Do you need an AI policy for employees?
Yes, and probably sooner than you think. The 2026 DBIR found 45 percent of employees are now regular AI users on corporate devices, up from 15 percent a year earlier. Most of them are pasting company information into tools nobody approved.
Banning it outright rarely works. Staff use these tools because they help, so a ban just moves the behavior onto personal phones where you have no visibility at all.
Name the approved tools and name what must never be pasted into any of them: customer data, credentials, financials, anything under contract. A short policy people actually read beats a long one they route around.
Is your website part of your attack surface?
Yes, and it is now the leading one. Vulnerability exploitation became the top initial access vector in the 2026 DBIR at 31 percent, overtaking stolen credentials for the first time in the report nineteen-year history. Unpatched software is how attackers get in most often.
For a small business, that usually means the website. An outdated plugin, an abandoned theme, a CMS two versions behind. Attackers scan for these automatically and do not care who you are.
Patching is not glamorous and it is not optional. Updates applied on a schedule, backups you have actually restored from once, and a maintenance plan somebody owns. Our approach to website security starts here, because the fanciest training will not save a site running a plugin from 2021.
How often should you run security training?
Short sessions quarterly beat one long session annually. People forget, staff turn over, and attack techniques change faster than your training calendar. A fifteen-minute refresher every quarter keeps the habits alive.
Run simulations between sessions, and vary the channel. If every test is an email, staff learn to spot test emails rather than learning to verify requests.
Are small businesses actually targeted?
Yes, because most attacks are not targeted at all. Automated scanning finds vulnerable sites regardless of company size, and social engineering campaigns go out to thousands of addresses at once. Being small makes you less interesting, not less reachable.
Small businesses also make softer targets. No security team, no help desk procedure, one person wearing four hats. Attackers know this. If you want a hand hardening the parts you own, start your project with us.
