Awareness training works when it changes behaviour. How to target the right habits, run phishing simulations fairly and build a security culture.
Security awareness training works when it changes what people do, not when it only produces completion certificates. An effective programme targets the behaviours attackers actually exploit, adapts content to each role, measures results and is backed by management. Built this way, it becomes part of a security culture rather than a yearly compliance exercise.
Most intrusions still begin with an action by a user or an administrator: opening a message, approving a sign-in prompt, reusing a password or sharing a file with the wrong person. In its Threat Landscape 2025 report, ENISA identified phishing as the leading initial intrusion vector, at roughly 60 percent of the cases it analysed, ahead of vulnerability exploitation. The agency also noted the spread of phishing-as-a-service kits, which let less skilled attackers run convincing campaigns.
Technical controls reduce this exposure, but they do not remove it. Mail filtering misses some messages, and attackers increasingly target help desks, collaboration tools and phone calls. People who recognise a suspicious request and report it quickly give the security team time to act.
Awareness is no longer a matter of good practice alone:
For organisations that must demonstrate compliance, an auditor will look for evidence that training is planned, adapted to roles, delivered and evaluated, not only for an attendance list.
Start from risks, not from a catalogue of modules. Identify the behaviours that matter most for your organisation, then build content around them:
Segment the audience. Executives and assistants face targeted fraud; finance teams face invoice and payment scams; developers handle secrets and code repositories; IT administrators hold privileged accounts and are prime targets for social engineering on the help desk. Each group needs scenarios that reflect its daily work.
Favour short, frequent sessions over a single annual course. Brief modules, practical exercises and reminders at the moment of risk (for example a banner on external emails) are easier to absorb than long presentations.
Simulated phishing campaigns help measure progress and give people practice in a safe setting. To keep them constructive:
The joint CISA, NSA, FBI and MS-ISAC guide on phishing recommends combining user training with technical measures such as phishing-resistant multi-factor authentication and email authentication (SPF, DKIM, DMARC). Training complements these controls; it does not replace them.
A security culture exists when secure behaviour is the normal and expected way of working. Several factors support it:
Measure the programme with indicators you can act on: reporting rate and time to report, repeat clickers, completion by role, number of incidents linked to human error, and results of short knowledge checks. Review these metrics with management and adjust content accordingly, in line with the continuous improvement cycle described by NIST.
Awareness programmes are usually led by the security or compliance team, which needs to place them within a management system. The ISO/IEC 27001 Lead Implementer training covers how awareness, competence and communication fit into an ISMS. Organisations subject to NIS 2 can use the NIS 2 Directive Foundation training to understand management and staff training obligations. Technical staff who want to understand how social engineering attacks are carried out can follow the EC-Council CEH v13 training.
Security awareness training is effective when it focuses on specific behaviours, fits each role, is repeated in short formats and is measured. Regulations such as NIS 2 and standards such as ISO/IEC 27001 now expect this approach. Combined with strong technical controls and visible leadership support, it helps turn employees into an active line of detection.