The result is predictable: they dutifully click through modules, but gain little from them. Not because they don't want to learn, but because the program doesn't help them prioritize. It feels arbitrary. As if everyone gets the same training, regardless of what they do, which systems they use, or what risks they actually face. Without a risk analysis, awareness becomes a kind of encyclopedic project: lots of information, little meaning.
The real problem: everyone gets the same training
Awareness only works when it connects with employees' realities. And that reality varies enormously by role. An HR advisor faces completely different risks than a researcher. A financial officer sees different types of messages than a teacher. A receptionist interacts with different people than an IT administrator. Yet, in many organizations, they receive exactly the same training.
"If you train for everything, no one learns what's truly important."
As soon as employees realize something isn't meant for them, they disengage. "This doesn't apply to me," they think. Or: "This is about systems I never work with." And then something important happens: they learn less well not because the content is poor, but because it doesn't feel relevant. A thorough risk analysis—who faces which risks, why, and in what context—makes this difference visible. Only then can you segment: by role, by department, by risk group. Not generic awareness, but focused attention. Not 20 topics, but the three that truly matter.
When you train on the most important things, something happens.
As soon as awareness is based on a clear risk analysis, the entire program changes. Employees receive information that is relevant to their work, their decisions, and their daily risks. It feels logical. More relevant. Even shorter. Because you no longer have to cover everything, only what matters.
A finance team learns how to recognize payment fraud. Lecturers learn about the risks associated with student data. Researchers learn about data classification and external collaborations. The training becomes meaningful. And meaningful behavior does stick. Segmentation isn't a luxury, but a prerequisite. It prevents noise, reduces resistance, and increases motivation. It makes awareness programs smaller, more focused, and more effective.
You don't change behavior by telling everyone the same thing, but by giving everyone the same thing.