Planning a 2027 Security Awareness Program That Actually Changes Behavior

Most security awareness programs are not planned. They are renewed. The same annual course gets re-licensed, the same quarterly phishing test gets re-scheduled, and the same completion report gets filed — while the attacks employees face change completely. November is when 2027 budgets get argued, which makes it the right moment to plan the program deliberately instead of extending it by default.

A good plan for 2027 needs four things: a measured baseline of where your human risk actually sits, a 12-month calendar that respects how memory works, staffing and budget sized to the goal, and metrics that will survive contact with a board. This guide walks through each, with the numbers to justify them.

Read the 2026 scoreboard before writing the 2027 plan

Plan against what attackers did, not what the last vendor deck said. Three data points set the stage for 2027.

The FBI's IC3 Internet Crime Report for 2025 recorded $20.9 billion in reported losses — up 26% in a year — and phishing/spoofing was once again the most-reported crime category, with 191,561 complaints. The Verizon DBIR attributes 62% of breaches to the human element. And in the SANS 2025 Security Awareness Report, 80% of more than 2,700 practitioners ranked social engineering as the top human risk — by a wide margin — with smishing and vishing growing in frequency and sophistication alongside email.

The practical reading: the threat concentrated on people, and it diversified across channels. A 2027 plan that only trains and tests against email phishing is planning for 2019.

Baseline first: you cannot plan around a number you do not have

Before choosing content or cadence, measure where you are. An unprompted, realistic phishing simulation across your workforce gives you a baseline failure rate; industry data says it will be uncomfortable. In KnowBe4's 2026 Phishing by Industry Benchmarking Report, the average organization starts at a 33.2% phish-prone rate before training — falling to 20.1% after 90 days and 4.2% after twelve months of sustained simulation plus training.

A single failure rate, though, hides the structure of your risk. Finance fails invoice lures; engineering falls for OAuth consent prompts; new hires fail everything for ninety days. Segment the baseline by department, role, and tenure, and fold in training discipline and reporting behavior to produce a human risk score you can track per team. That segmentation is what turns the 2027 plan from a curriculum into a risk-reduction roadmap: the teams and channels where you are weakest get the budget first.

Run the baseline in December or early January, before any new training lands, so the year's progress is measured from a clean starting point.

The 12-month calendar

Two findings should shape the calendar more than any content catalog. First, training effects decay: detection ability measured by Reinheimer et al. at USENIX SOUPS 2020 was no longer statistically significant six months after a training session. Second, annual compliance training on its own does not move behavior at all — Ho et al.'s IEEE S&P 2025 study of 19,500 employees found no significant relationship between training recency and real simulation failures. The cadence argument is laid out in detail in how often security awareness training should happen; the planning consequence is simple — spread small, frequent touchpoints across the year instead of concentrating hours into one event.

A quarterly skeleton for 2027:

Quarter	Theme	Core activities
Q1	Baseline & credentials	Company-wide baseline simulation; password manager and MFA push-abuse microlearning; publish the year's program to employees
Q2	Beyond the inbox	Vishing and smishing simulations; QR and collaboration-tool lures; targeted modules for finance (payment fraud) and IT/help desk (reset requests)
Q3	Reporting culture	Report-button campaigns and recognition; tabletop exercise with executives; new-hire pathway review before autumn onboarding wave
Q4	Pressure season	Holiday-themed simulations; deepfake and voice-clone briefings for finance and executives; year-end measurement and 2028 planning

Treat the themes as defaults, not dogma: if Q2's data shows a department still failing credential lures, Q3's plan for that department should change. The calendar is a hypothesis; the measurement program exists to revise it.

Staff and budget for behavior, not compliance

The SANS 2025 report puts numbers on something practitioners have long felt: influencing behavior takes at least 2.8 dedicated FTEs on average, and shifting security culture takes four or more — while lack of time and lack of staffing remain the top two obstacles programs face. For the sixth consecutive year, larger teams correlated with more mature programs.

Few organizations will fund four FTEs for awareness, and the plan should be honest about that. Two implications follow. First, automation has to carry the repeatable work — scheduling simulations, assigning follow-up training, chasing non-completions, compiling metrics — so the humans you do have spend their hours on the parts that need judgment: executive engagement, high-risk team interventions, and incident follow-through. Second, scope the 2027 goal to the capacity you actually get. A half-FTE program that promises culture change will fail publicly; the same program promising a measured reduction in failure rate on the two riskiest channels can succeed and earn the next headcount.

When the budget conversation turns hostile, argue from loss exposure rather than virtue — the training ROI math is strong enough to stand next to any other line item in the security budget.

A security awareness program is not a content subscription. It is a measurement program that uses content as one of its interventions.

Metrics that survive the board meeting

Completion rates are the metric of renewed programs: easy to collect and silent on risk. Ho et al.'s finding that 75% of employees closed an embedded training page within one minute is the completion metric's obituary — every one of those employees "completed" something.

Report these instead, quarterly, per department:

• Simulation failure rate and trend — the headline behavior number, benchmarked against the 33.2% → 4.2% industry trajectory so progress has context.
• Report rate and time-to-report — the single most valuable behavior to grow, because one early report can neutralize a campaign for everyone; it is also the only component that subtracts risk in a well-built scoring model.
• Human risk score by team — a composite that lets you show the board a distribution, not an average, and point budget at the tail.
• Real-incident correlation — whether teams with worse scores actually generate more security incidents; this is the number that converts skeptics.

Set explicit 2027 targets for each in the plan document. A target you did not write down in January is a target you will retrofit in December.

A 30-day rollout checklist

How to get from this article to an approved plan before the fiscal year starts:

1. Week 1 — Measure. Schedule the baseline simulation across email, SMS, voice, and QR channels; pull last year's incident and simulation data; segment by department and tenure.
2. Week 2 — Draft. Write the quarterly calendar, the metric targets, and the staffing ask; pre-align with legal and works councils on simulation ground rules where required.
3. Week 3 — Price. Get tooling and content costs on paper; size the automation so the FTE ask stays realistic; build the one-page ROI case.
4. Week 4 — Sell. Walk the CISO and CFO through baseline, plan, and targets; book the January executive briefing so leadership visibly launches the program rather than merely funding it.

The difference between a program that changes behavior in 2027 and one that re-runs 2026 is decided now, in planning season — before the first module ships. If you want to see what a measurement-first program looks like in practice, book a demo and we will walk you through one.

Sources

• FBI IC3 Internet Crime Report 2025 — FBI Internet Crime Complaint Center, April 2026. Used for: $20.9B reported losses (+26%), phishing/spoofing as most-reported category with 191,561 complaints.
• SANS 2025 Security Awareness Report — SANS Institute, 2025. Used for: 80% ranking social engineering the top human risk; 2.8 / 4+ FTE findings; top program obstacles; team size–maturity correlation.
• Verizon Data Breach Investigations Report — Verizon, 2026 edition. Used for: 62% of breaches involving the human element.
• Phishing by Industry Benchmarking Report — KnowBe4, 2026 edition. Used for: 33.2% baseline → 20.1% at 90 days → 4.2% at 12 months phish-prone rates.
• Understanding the Efficacy of Phishing Training in Practice — Ho et al., IEEE Symposium on Security and Privacy, 2025. Used for: null result on annual training recency; 75% closing embedded training within a minute.
• An investigation of phishing awareness and education over time — Reinheimer et al., USENIX SOUPS, 2020. Used for: training effect no longer significant at six months.