Security awareness training that changes behaviour, not just completion rates

Security awareness training is a mandatory control in every major framework - and one of the most commonly wasted. Annual click-through modules produce completion certificates and very little behaviour change. A programme that reduces risk looks different: role-based, frequent, short, and measured by what people do rather than what they finished.

What frameworks actually require

• ISO 27001 - awareness, education and training appropriate to role, with evidence of competence.
• NCA ECC and SAMA CSF - cybersecurity awareness programmes with periodic delivery and records.
• SOC 2 - evidence that personnel are trained on security responsibilities.
• PCI DSS - security awareness at hire and at least annually, with role-specific content for those handling card data.
• GDPR and PDPL - training for staff handling personal data.

Note the recurring word: records. The training content is not the evidence; the completion data is.

Make it role-based

One curriculum for everyone wastes senior people's time and under-trains high-risk roles. A workable split:

• Everyone - phishing and social engineering, password and MFA hygiene, data handling, incident reporting, physical security, safe use of AI tools.
• Developers - secure coding, dependency and secrets management, code review practices, the OWASP Top 10.
• Finance - business email compromise, invoice fraud, payment verification procedures.
• Executives - targeted attacks, whaling, travel security, and their governance responsibilities.
• IT and privileged users - privileged access hygiene, change control, logging obligations.
• Support and HR - identity verification before disclosing or resetting anything.

Phishing simulation, done ethically

Simulations are useful and easy to get wrong. Principles that keep them effective without damaging trust:

• Never punish reporting. The goal is a high report rate; someone who reports a real attack is doing exactly what you want.
• Avoid cruel lures. Fake bonus, redundancy or bereavement themes generate outrage rather than learning and can breach employment norms.
• Teach at the moment of failure with a short explanation of the specific cues that were present.
• Measure the report rate, not just the click rate. Reporting is the behaviour that shortens real incidents.
• Escalate support, not sanctions, for repeat clickers - coaching first.

Metrics that mean something

• Phishing report rate - the single best behavioural indicator.
• Time to first report - how quickly a suspicious message reaches security.
• Click rate trend by role and over time, not as a single number.
• Incident reporting volume from staff - a rise usually means the culture is improving.
• Completion within the deadline, including new joiners inside their first 30 days.
• Repeat-failure population and whether coaching reduced it.

Completion rate alone measures compliance with the training, not security. Report rate measures whether the training worked.

Cadence that sustains attention

1. At onboarding - before or immediately after system access is granted.
2. Annually - the formal refresher most frameworks expect.
3. Monthly or quarterly micro-content - a few minutes beats an annual hour for retention.
4. On change - new tooling, new threats, new regulation, or after an incident.
5. Just in time - contextual prompts when someone shares externally or handles sensitive data.

Key takeaways

• Records - not content - are the audit evidence.
• Role-based beats one-size-fits-all; developers, finance and executives need different material.
• Never punish reporting, and avoid cruel simulation lures.
• Track report rate and time to report, not just completion.