One of the assumptions many organisations make is that more awareness naturally leads to better security. It seems logical. Employees receive regular training, phishing simulations, security reminders and policy updates. The expectation is simple the more people know, the better decisions they will make.

After many years of working in cybersecurity, I have come to believe that it is not quite that straightforward. Organisations invest significant effort into awareness programmes, yet employees continue to fall victim to phishing attacks. It is easy to conclude that people are not reading the messages or are not taking security seriously. But sometimes reality is far more complicated.

A recent phishing simulation made me question this again. As part of an internal awareness exercise, an email containing both an embedded link and a QR code was circulated to users. One employee recognised that something was wrong, and did exactly what we want employees to do. He did not click the link. He did not scan the QR code. He reported the suspicious email.

The cybersecurity team responded and acknowledged his vigilance. More importantly, the response reinforced exactly the behaviour we wanted to encourage, stay cautious, do not click suspicious links, do not scan unknown QR codes, and report anything suspicious. It appeared to be a perfect example of cybersecurity awareness working.

Then, within ten minutes of receiving that acknowledgement, the same employee scanned the QR code.

That small incident says more about cybersecurity awareness than many training statistics ever could. He recognised the threat, understood the correct procedure and reported it. His decision was validated by the cybersecurity team. He was reminded not to interact with the email. And then, only minutes later, he did exactly that.

This was not simply an awareness failure. The awareness was clearly there. The more interesting question is what happened between knowing the risk and taking the risk. Perhaps curiosity took over. Perhaps the confirmation from the cybersecurity team  unintentionally removed some of the uncertainty around the email. Perhaps there was simply a desire to see what would happen, or perhaps the warning disappeared into the background as attention moved on to something else. The reason matters less than the lesson.

Cybersecurity awareness and cybersecurity behaviour are not the same thing.

We often measure awareness programmes through completion rates, simulation results, training attendance and the number of users reporting suspicious emails. These are useful indicators, but they do not tell us how someone will behave when faced with a decision. The employee in this case could easily have appeared in the statistics as an awareness success; he identified and reported the phishing email correctly. If the story had ended there, the programme would have worked exactly as intended. Ten minutes later, the behaviour told a different story.

This is where security awareness becomes difficult. Human beings do not make decisions based purely on knowledge. Curiosity, urgency, familiarity, distraction, confidence and even boredom all influence behaviour. Cybercriminals understand this extremely well. Their attacks are increasingly designed not simply to defeat technology, but to create a moment in which human judgement overrides what the person already knows.

QR-code phishing makes this particularly interesting. Scanning a code feels different from clicking a link. It often moves the interaction from the protected corporate environment to a personal mobile device, and the destination stays hidden until the code is scanned. Yet scanning has become such an ordinary part of everyday life that the action itself may no longer feel dangerous.

That creates a genuine dilemma for security teams. Send too few warnings and employees may not understand the risk; send too many and security becomes background noise. Run too few simulations and people are unprepared; run too many and employees start treating phishing exercises as games designed to catch them rather than lessons designed to protect them.

The objective therefore cannot simply be to create more awareness. Perhaps the real objective is not simply awareness, but security instinct. The desired behaviour should become almost automatic, stop, question, verify and report. And once something has been identified as suspicious, resist the urge to go back and investigate it out of curiosity.

This also changes how the effectiveness of an awareness programme should be measured. The number of training sessions delivered tells us what the organisation has done. The number of phishing emails reported tells us something about awareness. But what people do after recognising a threat tells us far more about security culture.

Technology can block many attacks. Policies can establish expectations. Training can provide knowledge. But ultimately there is a small space between awareness and action where a human being makes a decision. That may be one of the hardest risks in cybersecurity to manage.