Security Awareness Training That Changes Behavior

Most organizations train their staff on security because they are required to. NIST SP 800-171, CMMC and federal requirements all call for security awareness training. Too often the result is an annual module that people click through as quickly as possible, a completion report for the auditor, and no change in how anyone works.

Training is worth doing well, because attackers target people directly. Phishing, payment fraud and phone-based social engineering all depend on someone taking an action. Training that changes those actions reduces real risk.

Short and frequent beats long and annual

People forget what they are not reminded of. A long course once a year competes with everything else on a busy calendar and fades within weeks. Short, regular content works better:

• Brief modules of a few minutes, spread through the year.
• Timely topics, such as tax-season fraud, travel security before holidays, or a scam currently targeting your sector.
• Real examples from your own environment, such as a recent phishing message that was reported, with sensitive details removed.
• Plain language that explains what to do, not just what to fear.

Keep the annual requirement if your obligations call for it, and build the ongoing program around it.

Make it role-based

Different roles face different threats. Generic training treats everyone the same and misses the highest-risk scenarios.

• Finance and accounts payable: business email compromise, invoice and bank-detail change fraud, and verification procedures.
• HR and payroll: payroll diversion requests and handling of personal information.
• Executives and their assistants: targeted phishing, impersonation and travel risks.
• IT and administrators: help desk social engineering, privileged account protection and MFA reset requests.
• Developers: secure coding, secrets handling and dependency risks.
• Staff handling CUI: marking, storage, sharing and reporting requirements.

Phishing simulations done ethically

Simulated phishing can build recognition and give staff practice reporting. Done badly, it damages trust and teaches people to fear the security team.

• Teach, do not punish. Someone who clicks should get immediate, brief guidance, not public shaming or disciplinary action for a single mistake.
• Avoid cruel lures. Fake bonuses, layoffs or health emergencies may be realistic, but they can cause real distress and resentment.
• Vary difficulty and reflect the threats your organization actually sees.
• Coordinate with leadership, HR and the help desk so simulations do not cause confusion.
• Report results in aggregate to find where more support is needed.

Our social engineering assessments can test phishing, phone and in-person scenarios against agreed rules of engagement.

Build a reporting culture

The most valuable behavior is not never clicking. It is reporting quickly, including after a mistake. One early report can let the security team pull a phishing message from every mailbox before others fall for it.

• Provide a one-click report button in the mail client.
• Acknowledge reports and tell people when they caught something real.
• Make it clear that reporting a mistake will never be punished.
• Make it easy to report a suspicious phone call or text as well as email.

Measure behavior, not completion

Completion rates show that people opened the course. They do not show whether anything changed. Better measures include:

• Reporting rate for simulated and real phishing, and how quickly reports arrive.
• Repeat clicks by the same individuals, which suggest where targeted support is needed.
• Real incidents that involved a human action, and whether they were reported promptly.
• Process adherence, such as whether payment changes are verified as required.

NIST SP 800-50 provides a framework for building a cybersecurity and privacy learning program, including evaluation.

Frequently asked questions

How often should we run phishing simulations? Often enough to keep recognition and reporting habits fresh, but not so often that staff feel constantly tested. Many organizations settle on a regular monthly or quarterly rhythm.

Should people who click repeatedly face consequences? Start with additional support and one-on-one coaching. Reserve formal action for deliberate disregard of policy, not honest mistakes.

How CDT can help

CDT provides training for technical and non-technical staff, tailored to the threats our clients face, and our assessments help measure whether it is changing behavior.