Simulated, Not Communicated: How Broken Feedback Loops Undermine Security Awareness

Across many organizations, a pattern repeats itself. Phishing simulation runs. Results go to senior leadership. Employees who were tested hear nothing. No one knows if the organization passed or failed. A few months later, nothing has changed. Working in technology and risk consulting outside the security function, I had an angle on this pattern that practitioners often do not. The problem was never the simulation design. It was the silence after it. The communication loop was broken by default, and the industry had normalized it. The SANS Security Awareness and Culture Maturity Model names this failure precisely. Stage 2, Compliance Focused, measures success by completion rates with no metric for communicating results back to employees. Stage 3, Promoting Awareness and Behavior Change, is where phishing clicks and report rates first appear. The model identifies the crossing point. What does not spell out is the communication mechanism that gets organizations there. That is what this session addresses. The research confirms that Stage 2 is where most organizations are stuck. KnowBe4's 2025 report found a baseline phish-prone rate of 33.1% across 14.5 million users. Organizations with structured follow-through reduced that to under 5% within 12 months. Hoxhunt data shows a 7% threat reporting rate in compliance-driven programmes versus over 20% in mature behavior change programmes. The difference is not the simulation. It is what happens after it. Attendees will leave with two things. First, a five-step communication sequence for closing the feedback loop after any phishing or vishing simulation, covering timing, audience segmentation, and plain-language message framing. This is the practical mechanism for crossing from Stage 2 to Stage 3. Second, a long-term framework for progressing through Stages 4 and 5, drawn from behavior change evidence in adjacent fields and deliberately presented as an open industry debate, because the industry does not yet have consensus on what sustained culture change looks like at scale. That conversation needs to start somewhere.