Everyone completed the annual security module. The certificates are filed, the insurer’s box is ticked, and three weeks later somebody in accounts wired a deposit to a supplier’s “new bank account” on the strength of an email. Nobody involved was careless or foolish. The training simply did not reach the moment where the decision was made. Security awareness training that changes behaviour is built differently from training that produces certificates, and the differences are worth understanding before you buy or renew a programme.
Why the annual slide deck fails, and what works instead
A once-a-year module is designed around compliance: prove that every employee saw the material. It is long, generic and easy to click through, and it arrives at a random moment unconnected to anything the person is doing. Common sense says what everyone already suspects: nobody retains forty minutes of abstract warnings for twelve months, and nobody applies them under time pressure on a busy Thursday when an email that looks exactly like the boss asks for something urgent. The failure is not the staff. It is a format that treats awareness as a fact to be transferred rather than a habit to be built.
Short, frequent, and close to the moment
Behaviour changes through repetition and relevance. The programmes that work deliver a few minutes at a time, every few weeks, on one topic each: recognizing a request that pressures you to act quickly, checking a payment change by phone using a number you already have, what a multi-factor prompt you did not trigger means, why a document that asks you to “enable content” is a trap. Each piece is short enough to finish before attention wanders and specific enough to be recognized when the real thing arrives. Content that reflects your own business, the systems your people actually use and the requests they actually receive, lands harder than a generic library.
Phishing simulations done fairly
Simulated phishing emails are the most useful tool in the programme and the easiest to misuse. Done well, they are a practice environment: realistic but not cruel, varied in theme, sent to everyone including senior staff, and followed immediately by a short, calm explanation for anyone who clicked, showing the exact clues that were there to see. Done badly, they become a trap that humiliates people, and the result is a workforce that resents the security team and hides mistakes.
Some principles keep simulations fair. Do not use themes that exploit personal fear, such as fake bonus announcements or bogus layoffs. Do not publish names of people who clicked. Do not escalate difficulty faster than the training that supports it. Treat a click as a teaching moment for the individual and a signal about the programme, not a disciplinary matter. The aim is that people feel safe to say “I think I just clicked something”, because that sentence, said early, is what turns a potential incident into a non-event.
Building a reporting culture
The single most valuable behaviour is not “never click”; it is “report quickly”. A visible button in the mail client, a clear promise that flagging a message is always welcome even when it turns out to be harmless, and a fast, human thank-you when someone does so all matter more than any quiz score. When staff know that a suspicious message will be looked at by a person and that they will hear back, they flag more, and every real phishing campaign gets spotted earlier. Pair this with the technical layer: a well-configured secure email filter reduces what reaches the inbox, and reported messages feed back into that filter so the next copy never arrives.
Measuring what matters
Completion rates and click rates are the easy numbers, and both can be gamed. More telling indicators are qualitative: how many people flag simulated and real phishing rather than ignoring it, how quickly the first one arrives after a message lands, whether staff phone to verify payment changes without being prompted, whether people volunteer that they made a mistake, and what questions come up in the sessions. A programme is working when reporting rises, when the time to the first flag falls, and when the stories staff tell each other are about catching something rather than being caught.
Executives included, and visibly
The people most impersonated in business email fraud are the ones at the top, and the people whose approvals move the most money are close to them. A programme that exempts the leadership team, or that they are known to skip, tells everyone else the exercise is theatre. When a managing director completes the same short modules, receives the same simulations and mentions in a meeting that they nearly clicked one, the message lands in a way no policy document can achieve.
Common questions
How often should security awareness training happen?
Little and often works better than a single annual session. A short module every few weeks, on one topic each, with phishing simulations spaced through the year and a brief refresher for new starters on day one, keeps the material close to the moments when it is needed. Annual training can remain as a formal baseline for compliance, but it should not be the whole programme.
Are phishing simulations fair to staff?
They are when they are run as practice rather than as a trap: realistic but not cruel, free of themes that exploit personal fear, followed by immediate calm coaching for anyone who clicks, and never used to name or punish individuals. Run that way, they build confidence and reporting. Run as a gotcha exercise, they breed resentment and cause people to hide mistakes.
What should staff do if they think they clicked a phishing link?
Report it immediately using the agreed channel, whether a button in the mail client or a call to the help desk, without worrying about blame. Speed matters far more than embarrassment: an early warning lets IT reset credentials, isolate a device and alert others before any damage spreads. A culture where that call is welcomed is the most important outcome of a training programme.
How do we know awareness training is working?
Look beyond completion and click rates. Rising numbers of reported messages, a shorter time between a phishing email arriving and the first warning, staff phoning to verify unusual payment requests unprompted, and people openly admitting near misses are the signs that behaviour has changed. Those indicators are qualitative, but they are the ones that correspond to fewer real incidents.
If your current programme produces certificates but not confidence, our security awareness training and secure email solutions pages describe how we combine short training, fair simulations and a reporting culture with the technical layer, and you can contact us to talk about what would work for your people.
