A security awareness programme is not a once-a-year video course — it’s a recurring process combining education, simulated real-world attacks and measurement of actual behaviour change, because Verizon’s DBIR has for years shown the human element present in the majority of analysed breaches.
Quick Overview
What you’ll learn:
- How to design a security awareness programme from the ground up
- Which programme elements have the biggest impact on real employee behaviour
- How to use phishing simulations without triggering the opposite of the intended effect
- How to measure programme effectiveness beyond course completion rate
Who this article is for:
- Security and HR teams building a training programme
- CISOs responsible for reducing human risk
- Managers implementing compliance requirements (such as NIS2)
Reading time: 6 minutes
Employee security awareness: why a one-off training session isn’t enough
A classic once-a-year e-learning course creates a false sense of compliance — the employee “completed the course,” but security awareness research consistently shows that knowledge without repeated practice fades quickly, and actual behaviour under pressure (an urgent email from “the CEO”) diverges from stated theoretical knowledge. An effective programme has to combine three elements running on a cycle, not as a one-off: baseline education, simulated attacks and feedback delivered at the moment of a mistake.
Data from Verizon’s annual Data Breach Investigations Report has for years pointed to the human element (phishing, misconfiguration, social engineering) being present in the large majority of analysed security incidents — which makes employee awareness one of the most cost-effective areas of security investment, since the cost of training is disproportionately lower than the cost of a single successful ransomware attack.
The training programme, step by step
- Risk audit and group segmentation (month 1) — identify higher-risk groups (finance, HR, senior management — frequent targets of spear phishing) and tailor the programme to their specifics instead of running one universal course for the whole company.
- Baseline training for everyone (month 1-2) — phishing recognition fundamentals, password management rules, the procedure for reporting suspicious events. Short format (15-20 minutes), not a one-off multi-hour webinar.
- First phishing simulation (month 2) — a controlled, low-stakes test with no disciplinary consequences, run solely to establish a real baseline.
- Training for higher-risk groups (month 3) — deeper programmes for finance (Business Email Compromise), HR (fake CVs carrying malware) and senior management (spear phishing, audio deepfakes).
- Ongoing simulations and micro-training (continuous) — regular, progressively more sophisticated phishing simulations with immediate feedback delivered at the moment of a click.
- Measurement and reporting (quarterly) — tracking the click-rate trend across simulations, time-to-report for suspicious emails, and the employee reporting rate (not just the click count).
Phishing simulations: doing them right versus doing harm
A simulated phishing exercise only works if an employee who clicks a link receives immediate, non-judgemental feedback — a short explanation of what marked the message as fake, without publicising the result or applying disciplinary sanctions for a first mistake. KnowBe4’s Phishing By Industry Benchmark Report consistently shows that regular, repeated simulations combined with short follow-up training lower click rates in subsequent test waves compared to organisations without such a programme.
A common mistake is treating simulations as a tool for “catching” employees rather than an educational tool — publicly naming people who clicked a link drives them to hide mistakes instead of reporting them, which is exactly the opposite of the intended effect. A culture where reporting your own mistake is rewarded rather than punished generates more real reports of suspicious messages than a culture of fear.
How to measure programme effectiveness beyond completion rate
The percentage of employees who “completed the course” says nothing about actual behaviour change. Metrics that actually show programme effectiveness: the click-rate trend across successive simulation waves (it should steadily decline), the median time from receiving a suspicious message to reporting it (it should shorten), the ratio of reports to clicks (the higher, the better the reporting culture), and the number of real security incidents linked to the human element in a given quarter.
Read Also
- The NIS2 Directive - What Do Companies Need to Know and How to Prepare — employee awareness as part of NIS2 compliance
- Cybersecurity Certifications: CISSP vs CEH vs Security+ — a certification path for teams running security awareness programmes
Develop Your Skills
Building a security awareness programme is best started with the training Cyber Security Awareness Training. Check the programme and sign up to develop your skills with EITT experts.
FAQ
Is a one-off e-learning course enough as a security awareness programme?
No. Security awareness research consistently shows that knowledge without repeated practice fades quickly, and real behaviour under pressure differs from stated theoretical knowledge — an effective programme needs recurring education, simulations and feedback.
How often should phishing simulations run?
Regularly and on a cycle, not as a one-off — the most effective programmes run simulations several times a year, with increasing sophistication and immediate feedback the moment someone clicks a suspicious link.
Should employees who click a simulated phishing link be disciplined?
Not for a first mistake. Publicly naming people who clicked drives them to hide mistakes instead of reporting them — a culture where reporting your own mistake is rewarded generates more real reports of suspicious messages than a culture of fear.
What metrics best show whether a security awareness programme is working?
The click-rate trend across successive simulation waves (should decline), the median time to report a suspicious message (should shorten), and the ratio of reports to clicks — these say far more about real behaviour change than the course completion percentage alone.