There’s a reason phishing emails still work.
It’s not because people are careless.
It’s because attackers understand how our brains work.
Cybersecurity is often framed as a technical issue. But some of the most effective attacks don’t target software. They target psychology.
Why do people click even when they know better?
Let’s be honest. Most people have seen cyber awareness posters. They know what phishing is. They’ve had the training.
But real phishing emails are designed to bypass logic. They trigger emotion.
A sense of urgency. Authority. Scarcity.
Messages like “Your salary has been withheld” or “Action required to avoid legal penalties” make even trained professionals act without thinking.
This isn’t a tech flaw. It’s a human one. And it’s entirely predictable.
The tactics behind successful social engineering
Here are a few psychological principles attackers regularly exploit:
• Authority: Posing as someone senior in the organisation
• Urgency: Pressuring the target to act fast, “before the deadline”
• Familiarity: Using names or situations that feel known
• Fear or loss: Claiming access will be revoked, or money is at risk
Why traditional training isn’t enough
Telling staff to “stay alert” or “never click unknown links” is not a strategy.
Awareness is not the same as behaviour change.
Training needs to do more than inform. It must build habits, reinforce memory, and challenge automatic responses.
The most effective programmes we’ve seen in UK SMEs combine simulated attacks, microlearning, and reflection.
Short, real examples. Engaging delivery. And most importantly, repetition.
Think less “annual compliance video” and more “what would you do if this landed in your inbox today?”
What businesses can do now
If you’re reviewing your internal cybersecurity awareness plan, consider these steps:
• Run a phishing simulation and measure results
• Share real-world examples from similar sectors
• Invite feedback on what training staff remember
• Keep it short, varied, and relevant to different departments
• Avoid blame. Focus on improving reactions, not shaming mistakes
And if you’re in HR, Legal, or Finance, you’re not just a support team. You’re on the front line. Your inbox is often where the attack begins.
Let’s make security personal again.
