Is security training for employees effective?

This has been very effective for our organization, we do it for every new employee and annually for everyone.

Depends very much on the training, the employee, and senior management buy in

Yes, but as with any good digital adoption training it needs to relevant, responsive, and personalized to the employees.

An important part of security training is the practical test. The only company I worked with that did that was Salesforce. The red team would send fake emails to all the employees to see who would open them. And it was not to blame anyone; it was a part of the education and a great exercise. I’ll be honest, I fell for them at least once if not a couple times, which is a little scary because I think I'm pretty safe and I couldn't figure out whether it was a fake email or not.

There also are great tools—like Splunk, for example—that provide great monitoring over infrastructure. But then it becomes an issue of cost. Not many SMBs and startups can afford solutions like Splunk.

Some of the tools that are out there—such as those for phishing—are probably pretty effective. Some of them occasionally send faux phishing messages to people to see how they react and then coach them according to how they respond. 

We used to have to do compliance training where I worked because it was a medical device company. It was like a chore, but in the end you felt a bit empowered to have done it. You felt like you knew a bit more about some of the business’s risk; the same thing happens through cybersecurity training.