Most security incidents involve a human element: phishing, credential reuse, social engineering, accidental data exposure. Awareness training tries to teach humans to recognize and avoid these.
Done well, it works. Done poorly, it's compliance theater.
This page covers what actually works.
Specific attack patterns to defend against:
Email or message that tricks users into clicking malicious links, providing credentials, or downloading malware. The dominant initial attack vector.
Targeted phishing aimed at specific individuals (CEO, finance team, IT admin). More personalized; harder to detect.
Manipulation outside email: phone calls pretending to be IT support, USB drops in parking lots, tailgating into buildings.
Users using the same password across services. Breach of one site compromises others.
Users sharing files publicly when they meant private; emailing sensitive data to wrong addresses.
Send fake phishing emails to employees. Track who clicks. Provide immediate education to those who do.
Frequency: monthly is reasonable. Variety: different types of phish (credential capture, malware, financial fraud).
Outcomes:
For most companies, this is the highest-impact training intervention.
Different roles face different risks:
Generic training that treats everyone the same misses these.
When a real attack happens, share details (without blaming). "Last month, an attacker tried X. Here's how it worked. Here's how to recognize it."
Concrete examples beat abstract advice.
People should report suspicious emails, weird behavior, accidental clicks. Fast.
Pre-requisites:
If reporting feels punitive, people hide problems.
The 30-minute video everyone clicks through to satisfy SOC 2. Most people don't retain it.
Effective only if there's a compliance requirement and you're checking the box. Don't expect behavior change.
"Don't click suspicious links" — too vague to act on.
Public shaming for clicking phishing simulations. People stop reporting; problems hide.
Hour-long training sessions; people zone out. Short, frequent micro-trainings work better.
Training without other controls. Even well-trained people make mistakes. Defense in depth: training + technical controls (MFA, email filtering, etc.).
Use MFA everywhere. Authenticator app preferred over SMS. Hardware keys for high-value accounts.
The "MFA fatigue" attack: attacker triggers MFA prompts repeatedly until user approves. Train people to recognize this.
Use one. Don't share passwords. Don't reuse passwords. The password manager handles unique passwords without burdening memory.
"CEO wants you to wire $100K to this account immediately." Always verify by another channel; never act on email alone for wire transfers.
Use VPN on untrusted networks. Don't enter credentials over coffee shop WiFi without it.
Report immediately. Modern device management can remote-wipe.
Don't plug in unknown USB drives. The "USB drop in parking lot" attack is real.
Many frameworks (SOC 2, HIPAA, ISO 27001) require security awareness training. Annual minimum for most.
Compliance training and effective training overlap but aren't identical:
Try to do both. Compliance training that's also effective is the goal; compliance theater that doesn't change behavior is the failure mode.
For most companies:
The combination of training + technical controls + culture is what reduces incidents.