What Is Adaptive Security Awareness Training?

Key takeaways

• Adaptive security awareness training sets the content, timing and difficulty of each lesson from an individual employee's recent behaviour and risk signals, instead of sending everyone the same annual course.
• A lesson is triggered by an event, such as clicking a simulated phishing email or reporting one, and arrives within minutes rather than at the next scheduled campaign.
• The outcome to measure is behaviour: reporting rate, time to report, and whether the same employees keep being exposed. Not course completion.
• Keepnet data across 102,452 employees in 158 organisations shows an employee's first simulated phishing email is the one they are most likely to click, at 9.2%, falling to 4.8% across every simulation that follows.

The Short Definition

Adaptive security awareness training is a model in which the content, timing and difficulty of each lesson are set by an individual employee's recent behaviour and risk signals rather than by a fixed annual schedule.

The difference is where the assignment comes from. In a traditional programme, the calendar decides: everyone receives the same module in the same month. In an adaptive programme, an event decides: an employee who interacts with a simulated phishing email receives a short lesson on that specific pattern, in minutes, while an employee who reported it receives something else or nothing at all.

How Adaptive Training Differs From Annual Security Awareness Training

Annual vs adaptive security awareness training

What Triggers a Lesson

An adaptive programme runs on events, not dates. These are the triggers that matter in practice:

• An employee clicks a link in a simulated phishing email.
• An employee submits credentials on a simulated landing page.
• An employee reports a suspicious message, which is the behaviour the programme is trying to build.
• The same employee is exposed repeatedly across a quarter.
• An employee changes role, team or access level.
• A new joiner reaches their first week.
• A new attack pattern appears in your sector, such as a callback lure or a deepfake voice request.

Timing is the point. A lesson that arrives in minutes attaches to a moment the employee remembers. The same lesson delivered in next quarter's campaign attaches to nothing.

What the Platform Adapts

Content

The module matches the pattern the employee met, not the annual curriculum. An employee who interacted with an invoice lure receives an invoice lesson, not a general phishing overview.

Channel

Attackers do not stay on email, so the programme should not either. Multi-channel phishing simulations, not email-only, are what expose the gap: the 2026 Verizon Data Breach Investigations Report puts the median click rate on email simulations at around 1.4%, while phone-centric simulations run at around 2%, roughly 40% higher than email.

Source: Verizon 2026 Data Breach Investigations Report, p. 50.

Difficulty

An employee who reports consistently should meet harder scenarios. An employee who has just met their first simulation should not. A programme that sends the same difficulty to both learns nothing about either.

Frequency

Cadence tightens after a clicked simulation and eases after sustained reporting, so each employee receives the minimum effective amount rather than a fixed quota.

Language and region

A translated module is not a localised one. Adaptation includes examples an employee in that market would actually receive, in the language they work in.

How to Tell If It Is Working

This is where most programmes stop short. Completion tells you the course was delivered. It does not tell you the behaviour moved. The 2026 Verizon Data Breach Investigations Report attributes 62% of breaches to the human element, which is the same share it has held while completion rates across the industry sat near 100%.

Source: Verizon 2026 Data Breach Investigations Report, p. 12.

Three numbers show whether an adaptive programme is doing its job.

1. Click rate across repeated exposure, for the same employees

Keepnet analysed email phishing simulations delivered between January 2020 and September 2026, ranking each simulation per employee and holding the same employees at every rank. An employee's first simulated phishing email is the one they are most likely to click: 9.2%, falling to 4.8% across every simulation that follows. The template difficulty mix stayed flat between the first simulation and the twelfth, so the drop is not explained by easier templates.

Source: Keepnet anonymised customer research, email phishing simulations delivered 1 January 2020 to 29 September 2026, employees who received at least 12 simulations (n=102,452 employees across 158 organisations). Methodology: doc.keepnetlabs.com/resources/research-methodology.

The same finding measured one organisation at a time is stronger. The median organisation's click rate fell from 3.4% on its employees' first simulation to 1.4% by their twelfth, a 58% drop, against 48% in the employee pool. Measuring by organisation answers the obvious objection, that a handful of large employers are carrying the average.

Source: Keepnet anonymised customer research, email phishing simulations delivered 1 January 2020 to 29 September 2026, organisations whose employees received at least 12 simulations (n=158 organisations). Methodology: doc.keepnetlabs.com/resources/research-methodology.

2. Your own baseline, not the published median

The first-simulation click rate is stable between 9% and 10% across every cohort Keepnet tested, up to 498,861 employees. That makes it usable as a starting benchmark. It also sits far above the published simulation medians, because those medians are dominated by employees already inside a running programme. Judge your programme against your own first measurement, not against a number collected somewhere else.

3. Reporting, and how fast

Reporting rate and time to report are the two numbers that change what your security team can actually do with an incident. Track them per channel, because an employee who knows the email button may have no idea how to report a call.

What to Look For in a Platform

Six checks that separate an adaptive programme from a scheduled one with a new label.

• Trigger depth. Ask which events can start a lesson. If the answer is only a clicked link, the programme is reactive on one signal.
• Time to lesson. Ask how long between the event and the lesson reaching the employee. Minutes and next quarter are different products.
• Channel coverage. Ask what happens beyond email: SMS, voice, QR and callback scenarios where your employees are actually targeted.
• Behaviour reporting. Ask for reporting rate, time to report and repeat exposure by team and role. If the reporting screen leads with completion, adaptation is cosmetic.
• Content freshness. Ask when the library was last updated and how quickly a new attack pattern becomes a module.
• Proof. Ask the vendor for their own measured before and after, with the population and the sample size stated. Most cannot produce one.

Common Questions

Is adaptive security awareness training the same as personalised training?

Personalisation usually means the module carries the employee's name and role. Adaptation means the assignment itself changes based on what the employee did. A programme can be personalised and still send everyone the same course in the same month.

How long before behaviour changes?

In Keepnet's data the largest single drop appears between an employee's first simulation and the next, and the lower rate holds across the ones that follow. In practice this means the first few exposures carry most of the change, not the twelfth.

How quickly can a programme start?

More than half of organisations that joined Keepnet between January 2025 and June 2026 launched their first email phishing simulation within two weeks of licence start, and nearly two in three within 30 days.

Source: Keepnet anonymised customer research, email phishing simulations, accounts and licences starting January 2025 to June 2026 (n=428 organisations). Methodology: doc.keepnetlabs.com/resources/research-methodology.

Does adaptive training replace compliance training?

No. Compliance training proves a requirement was met on a date. Adaptive training changes what employees do. Most organisations need both, and the mistake is reporting the first and calling it the second.

What should we measure in the first quarter?

Reporting rate, time to report, and the click rate on the first simulation each employee receives. Those three give you a baseline you can defend and compare against later.

See It on Your Own Environment

Run a short programme on a subset of employees and compare the three numbers above before and after. More than 4 million employees have taken a Keepnet simulation or training.

Compare the options: Best Security Awareness Training Tools in 2026

Looking at Adaptive Security specifically: Adaptive Security Alternatives in 2026