What Is Security Awareness Training?

Security awareness training is the effort to change how people behave around security risk. It is the most universally deployed and most variably effective control in the field.

The variance comes from what is being attempted. Training that aims to transfer knowledge achieves very little; training that aims to change a specific behaviour in a specific situation can achieve a great deal.

Why the annual module fails

A once-yearly course covering everything is designed for evidence of completion rather than for retention. People click through it, pass the quiz and retain almost nothing, which the completion rate records as success.

Short, frequent, specific interventions perform better on every measure. Behaviour change is not a knowledge problem and cannot be solved by more content.

Phishing simulation, done without punishment

Simulation is the most common measurable component and the easiest to run badly. Punitive programmes — naming people, disciplinary consequences, difficulty designed to catch people out — produce fear, and fear produces under-reporting.

Under-reporting is the outcome you least want, because the reporting rate is a genuine security control: a real phishing campaign reported within minutes by one person can be blocked for everyone.

Measure reporting, not just clicking

Click rate is the usual headline and is the less informative number. Reporting rate says whether people will tell you, and time to first report says how quickly you would learn about a real campaign.

A population that clicks occasionally and reports quickly is in a considerably better position than one that clicks rarely and says nothing.

Content that matches the actual threat

Generic material about suspicious links has limited value. What changes outcomes is material addressing what actually targets your people: invoice fraud in finance, credential phishing against clinical staff, supplier impersonation in procurement, help-desk-impersonation calls.

Role-specific training reaches far fewer people and changes far more behaviour per person reached, which is usually the better trade.

Make the safe action easy

A one-click report button in the mail client produces more reporting than any amount of instruction to forward suspicious messages to a mailbox. A clear, fast route to ask whether something is legitimate prevents the decision being made alone under time pressure.

Where the secure path is slower or harder than the insecure one, training is arguing against the design of the system, and the design usually wins.

Behaviours worth measuring beyond phishing

Simulation measures one behaviour. Others are equally informative and rarely tracked: how many people report suspicious phone calls, whether staff use the approved password manager, whether sensitive data leaves through approved channels, how quickly people report a lost device.

Each is observable from data the organisation already holds, and each describes something a real attack would exploit. A programme reporting only click rate is measuring the one behaviour its tooling happens to generate a number for.

Where to start

Check whether your reporting mechanism is one click from the mail client, and what your reporting rate is. Those two facts predict how a real campaign would go better than your click rate does.

See creating a human firewall, training that respects reality and how phishing still works. GuardsArm delivers security awareness training.