What is security awareness training?

Security awareness training is an ongoing program that teaches people across an organization to recognize the most common threats, from phishing to credential misuse, and to report them promptly instead of ignoring or hiding them. It is not a one-off course: NIST SP 800-50 Rev. 1 describes it as a lifecycle across three tiers, awareness for everyone, targeted training for people with specific operational responsibilities, and education for specialists, each on its own cadence. The distinction matters because the most widely delivered tier, aimed at anyone with a company account, should not teach technology: it should build a reflex, recognizing a warning sign and pausing before clicking a link, typing a password or authorizing a payment. It concerns anyone who receives mail, manages a supplier or has access to sensitive data, not just the IT department.

See also: Phishing · Deception that pushes a person into handing over credentials, data or money by faking a legitimate sender.

Phishing simulations and their ethical limits

Phishing simulations, emails built to imitate a real attack and test how people react, are the program's most common tool because they test behavior instead of checking whether a slide was read. Measuring them by click rate alone is a mistake, since a well-built campaign fools attentive people too: the indicator that matters is the time between exposure and report. A test designed to trap as many people as possible, or whose results end up in a public ranking or an individual evaluation, produces the opposite effect: whoever fell for it once learns to hide it, not to report it. The phishing technique used as a test only works as a diagnostic tool.

Why training does not replace technical controls

A training program reduces how often a person becomes an attack's entry point, but it does not remove the possibility: even well-trained staff can click a link in a distracted moment. That is why training should be designed alongside technical controls, not in their place. The clearest case is phishing-resistant multi-factor authentication: passkeys and FIDO2 keys strip value from a stolen credential because they are cryptographically bound to the service domain, so even the best-trained person who lands on a cloned page hands over nothing reusable. The law, too, looks first at decision makers: the NIS2 directive, at article 20(2), requires members of management bodies to follow cybersecurity training and asks Member States to encourage companies to offer similar training, regularly, to employees.

An enterprise example

A manufacturing company falling under NIS2 rolls out a program in three moves: annual training for the board, mandatory under article 20; phishing simulations targeted at finance's most concrete risk, a request to change bank details, with a direct reporting channel and no consequence for clicking as long as it is reported right away; and mandatory passkeys on every account touching sensitive data or payments, so that even one tired day's wrong click is not enough on its own to hand over access.

Why it matters for decision makers

A training program should be judged on what changes in behavior, reporting time, channels used, poorly handled incidents, not on how many people completed an e-learning module. And it should be designed knowing it is not enough alone: it reduces the risk of the first click, it does not remove it. An incident response plan already written is what turns a timely report into real containment.