Security training cuts incidents for 67% of organizations

Security awareness training is helping organizations reduce cyber intrusions, incidents, and breaches, according to Fortinet’s 2025 Security Awareness and Training Global Research Report.

The report found that 67% of organizations saw moderate or significant reductions in intrusions, incidents, and breaches after implementing security awareness and training programs.

Fortinet said the findings show that security awareness training has moved beyond a compliance exercise and is now a measurable control for reducing cyber risk.

The report was based on responses from 1,850 senior IT and security leaders worldwide, including respondents from the Philippines.

Sapio Research conducted the online interviews in November 2025 across 29 locations, with overall results accurate to ±2.3% at a 95% confidence limit.

AI-driven threats are reshaping how employees and executives view cybersecurity training.

Fortinet said 88% of respondents reported that attackers’ use of AI has increased employee awareness of why security training matters, but only 40% said employees are highly trained and ready to identify, avoid, and report AI-based cyberthreats over the next 12 months.

The report said 58% of respondents considered employees moderately or slightly prepared for AI-driven threats, while 2% said employees were not ready at all.

Organizations are responding by training workers on the proper use of generative AI, or GenAI, tools, monitoring or blocking sensitive data sharing, and adopting policies for AI tool use.

Fortinet said 53% of organizations train employees on proper GenAI use, 53% use technology to monitor or block the sharing of sensitive information with AI tools, 48% are implementing policies for AI tool use, and 45% maintain authorized app lists.

The report also found that 96% of respondents either have or are implementing security policies for GenAI apps and other AI tools.

External threats remain the main reason organizations invest in security awareness programs.

Fortinet said 41% of respondents cited potential threats, past breaches, and breaches in the same industry as the biggest motivators for adopting security awareness and training in 2025, down from 52% in 2024.

Insider risk is also rising as a concern.

The report said 27% of respondents adopted security awareness and training to protect against insider risks, up from 4% in 2024, though Fortinet noted that new survey options related to insider risk may have contributed to the increase.

Training priorities reflect that changing risk environment.

Data security remained the top topic at 51%, followed by data privacy at 43%, and AI-based tools and threats at 41%.

Bambi Escalante, Country Manager, Philippines, Fortinet, said Philippine organizations are increasingly treating cybersecurity as both a technology and workforce readiness issue.

“Organizations in the Philippines are increasingly recognizing that cybersecurity is not just a technology challenge but also a skill and awareness challenge. As businesses continue to adopt cloud platforms, digital services, and AI-driven tools, employees often become the first point of exposure to cyber risk. Security awareness training helps transform that frontline into a strong first line of defence. Consistent and relevant training equips employees to identify threats such as phishing, social engineering, and emerging AI-enabled attacks before they escalate. By embedding security awareness into everyday workplace culture, Philippine organizations can strengthen resilience, protect sensitive data, and support the country’s continued digital transformation.”

The findings come as the Philippines implements the National Cybersecurity Plan 2023–2028, which was adopted under Executive Order No. 58 as the country’s whole-of-nation roadmap for cybersecurity. (Supreme Court E-Library)

That plan directs national government agencies, government-owned and -controlled corporations, and local governments to align cybersecurity strategies with the national roadmap. (Supreme Court E-Library)

Fortinet said organizations are also improving how they measure training outcomes.

The most common measures were reduced security incidents at 53%, employee feedback at 52%, and security audits at 50%.

Many organizations also combine in-person and computer-based training with simulations, assessments, and reinforcement programs to shift behavior over time.

Completion remains a weak point.

Only 6% of organizations reported 100% training completion, while 56% reported completion rates above 70%.

Fortinet said 69% of leaders still feel employees lack sufficient cybersecurity awareness, even as training programs expand.

The report recommended shorter and more frequent modules, stronger accountability for completion, closer alignment between content and current threats, visible leadership support, and regular microtraining to keep pace with AI.

Fortinet said security awareness is increasingly becoming a cultural issue rather than just a procedural requirement.

The company said training programs should shape daily decisions, reinforce good behavior, and reduce risk in the places where employees actually work.

Fortinet also said the Fortinet Training Institute offers role-based security awareness training, technical certifications, and hands-on learning paths designed to improve employee readiness and strengthen security posture.