Part 5 of the Breaking Down Security Silos Series
By Christopher Stavalone
The Human Element of a Connected Security Ecosystem
Throughout our Breaking Down Security Silos series, we’ve explored how cybersecurity tools become more effective when they share information and operate as part of a coordinated security strategy. From penetration testing and vulnerability management to patch management and endpoint detection and response (EDR), each connection provides additional context for identifying, prioritizing, and reducing risk.
But not every attack begins with a software vulnerability or an unpatched system.
Sometimes, the initial point of compromise is a person.
Phishing, credential theft, business email compromise, and other social engineering techniques continue to provide attackers with opportunities to bypass technical defenses by exploiting legitimate user access.
Organizations often address these threats through Security Awareness Training (SAT) and simulated phishing campaigns. However, the information generated by these programs frequently remains isolated from broader security operations.
That represents another security silo—and an opportunity to improve how organizations understand and respond to risk.
Security Awareness Training Is More Than a Compliance Requirement
Security awareness training is commonly treated as an administrative responsibility. Employees complete annual training modules, participate in occasional phishing simulations, and acknowledge security policies.
While these activities have value, completion alone does not demonstrate that an organization has meaningfully reduced human risk.
An effective SAT program should help organizations answer more important questions:
- Are employees becoming better at recognizing social engineering attempts?
- Are suspicious emails and other potential threats being reported promptly?
- Are certain departments or job functions experiencing greater exposure?
- Are training efforts addressing the behaviors most relevant to the organization’s threat landscape?
- Are improvements in user behavior contributing to stronger security outcomes?
These questions shift the focus from compliance to measurable risk reduction.
The objective of security awareness training should not simply be to educate users. It should be to influence behavior in ways that strengthen the organization’s overall security posture.
Phishing Simulations Provide Valuable Security Intelligence
Simulated phishing campaigns are among the most useful components of a security awareness program because they provide observable information about how employees respond to potential threats.
Depending on the platform, organizations can measure:
- Interaction with simulated malicious links or attachments
- Submission of credentials during simulations
- Reporting rates for suspicious messages
- Repeat susceptibility across multiple campaigns
- Behavioral improvements following targeted training
These metrics help identify opportunities for additional education and process improvements.
However, phishing simulation results require context.
A single failed simulation does not necessarily indicate that an employee represents a significant security risk. Likewise, a low click rate does not guarantee that an organization is adequately protected against social engineering.
Results should be evaluated over time, alongside the difficulty of simulations, reporting behavior, job responsibilities, and other relevant factors.
The real value comes from identifying patterns and using those insights to improve security practices.
Connecting Human Risk to Endpoint Detection and Response
This is where security awareness training can begin to inform technical security operations.
Consider a scenario involving an employee who interacts with a malicious phishing email.
The message contains a link to a credential-harvesting website. The employee enters their credentials, potentially giving an attacker access to a legitimate account.
From there, the attacker may attempt to access organizational resources, establish persistence, or compromise an endpoint.
Different security controls provide visibility into different stages of this activity.
Security awareness training helps employees recognize and report suspicious messages.
Email security controls may identify and block malicious messages or links.
Identity security and authentication logs can reveal suspicious sign-ins, unusual access patterns, or attempts to misuse compromised credentials.
EDR can detect suspicious endpoint activity associated with malicious payloads, unauthorized processes, or attempts to establish persistence.
Each control provides a different piece of the investigation.
When security teams can correlate those signals, they gain a more complete understanding of what occurred and how to respond.
It’s important to distinguish between a simulated phishing event and an actual compromise. Training results do not automatically indicate malicious activity, and EDR alone may not detect credential misuse occurring entirely within cloud applications.
The goal is not to treat every failed simulation as a security incident. It is to ensure that relevant human-risk information can inform technical investigations when appropriate.
Turning Security Awareness Data Into Actionable Workflows
Connecting security awareness training with security operations does not necessarily require every platform to have a direct technical integration.
For many organizations, particularly SMBs with limited IT resources, effective communication between teams and clearly defined response procedures can provide substantial value.
A connected workflow might include:
- Identify behavioral patterns
Phishing simulations reveal that employees in a particular department are consistently struggling to recognize credential-harvesting attempts.
- Deliver targeted education
Rather than assigning generic training to the entire organization, the security team provides relevant microlearning focused on credential theft, suspicious authentication requests, and reporting procedures.
- Review related technical exposure
Security teams assess whether the department’s access privileges, authentication controls, and email security protections appropriately reflect its risk profile.
- Strengthen monitoring and response
Where justified by actual exposure and threat intelligence, teams refine relevant email, identity, or endpoint detections and ensure reporting procedures are understood.
- Measure improvement
Subsequent simulations and operational metrics help determine whether employees are recognizing threats more effectively and reporting suspicious activity sooner.
This creates a feedback loop between education, security controls, and operational decision-making.
Rather than operating as a standalone training initiative, SAT becomes part of the organization’s broader risk management process.
Why Human Risk Cannot Be Solved With Training Alone
One of the most important principles in security awareness is recognizing that even well-trained employees can make mistakes.
Modern phishing campaigns increasingly use convincing impersonation, compromised legitimate accounts, and sophisticated social engineering techniques.
Attackers may also exploit legitimate authentication workflows, trusted business relationships, or routine operational processes.
Expecting users to identify every malicious interaction is unrealistic.
Organizations must therefore combine security awareness with technical safeguards such as:
- Multifactor authentication, preferably phishing-resistant methods where appropriate
- Email filtering and malicious URL protection
- Least-privilege access controls
- Endpoint detection and response
- Identity monitoring and suspicious sign-in detection
- Clear incident reporting and escalation procedures
These controls should reinforce one another.
Training helps users recognize and report threats. Technical controls help prevent, detect, contain, and investigate attacks when user awareness alone is insufficient.
Security awareness should strengthen technical defenses—not carry the responsibility for preventing compromise by itself.
Measuring Human Risk Beyond Phishing Click Rates
Phishing click rates are commonly used to evaluate security awareness programs, but they provide only a limited view of effectiveness.
A more mature approach evaluates whether the program is improving how employees recognize and respond to threats.
Useful measurements include:
Phishing reporting rate: The percentage of simulated suspicious messages that employees report through approved channels.
Repeat susceptibility: Whether employees demonstrate consistent difficulty recognizing certain types of phishing attempts across multiple campaigns.
Reporting speed: How quickly suspicious messages are escalated to the appropriate security team.
Training effectiveness: Whether targeted education produces measurable behavioral improvement over time.
**Incident-related
