Cyber Security
Security awareness training that works: short, regular and fair
One mandatory session a year is not enough. Here is how to build an awareness programme that takes staff seriously, uses phishing simulations fairly and leads to more reports, not just fewer clicks.
Q-entra editorial teamPublished on 5 min read
Contents
- What makes security awareness training effective?
- Short and regular instead of once a year
- Running phishing simulations fairly
- Role-specific topics: who is attacked, and how?
- Onboarding: security from day one
- Reporting culture: reporting must be easy and welcome
- Measuring success: reporting rate, not just click rate
- Getting started in four steps
Key takeaways
- Effective awareness training is short, regular and practical: a few minutes a month instead of one long mandatory session a year.
- Phishing simulations only work if they are fair: announce the programme, never shame anyone, explain immediately and involve the works council and data protection early.
- Finance, reception, IT, HR and management need their own focus areas because they are attacked in different ways.
- Security belongs in onboarding, from day one.
- The most important metric is the reporting rate: how many people report suspicious messages, and how quickly?
What makes security awareness training effective?
Effective awareness training changes everyday behaviour, not just knowledge for a test. It works through short, regular sessions, realistic examples, content that matches each role and a culture in which reporting is explicitly welcome. Success is measured mainly by how many employees report suspicious messages.
A yearly mandatory session with an hour of slides ticks a box but rarely sticks. For organisations within the scope of NIS2, training is also explicitly part of the risk management measures, and members of management must take part in training themselves. That makes it all the more important that the time invested has an effect.
Short and regular instead of once a year
People quickly forget what they do not use. Short prompts at regular intervals keep the topic in people's minds without disrupting daily work. These formats have proven useful:
- Short e-learning units of five to ten minutes, roughly once a month
- Current, anonymised examples from your own inboxes in team meetings
- Brief live sessions on individual topics such as invoice fraud or MFA
- Phishing simulations at irregular intervals and with changing themes
- Short warnings on the intranet or in chat when a current attack wave is circulating
Plain language without jargon is essential. Training should also cover the phone, text messages and chat, not only email.
Running phishing simulations fairly
Simulated phishing emails show whether the lessons work in everyday life. Done badly, however, they destroy trust: anyone who feels they have been made to look foolish would rather report nothing next time. These ground rules work well in practice:
- Transparency: everyone knows that simulations take place, just not when or with what content.
- No shaming: results are evaluated in aggregate, without lists of names for line managers.
- Learning, not punishment: anyone who clicks immediately sees a short explanation of the warning signs the email contained.
- Stay fair: no lures with false promises such as bonus payments or pay rises, and no topics that cause personal distress.
- Data minimisation: the platform does not store entered passwords and keeps only the data it needs.
Role-specific topics: who is attacked, and how?
Attackers often choose their method to suit the role of the person they target. A basic module for everyone makes sense; on top of that, individual groups should get their own focus areas:
- Finance and accounts: invoice fraud, changed bank details and CEO fraud. Focus: call back on a known number and apply the four-eyes principle to transfers.
- Reception and office management: callers posing as someone else, visitors without an appointment, deliveries and people who simply follow someone through the door (tailgating). Focus: verify identities, follow the visitor process and let no one in unchecked.
- IT and administration: fake requests to reset passwords or MFA and targeted attacks on admin accounts. Focus: verify identity for support requests, use separate admin accounts and phishing-resistant MFA.
- Human resources: applications with malicious attachments and supposed employees asking to change the bank account for their salary. Focus: secure routes for documents and changes to bank details.
- Management: targeted attacks using publicly available information and misuse of their names for CEO fraud. Focus: clear approval rules that apply to management as well.
Onboarding: security from day one
New employees do not yet know the processes, the contacts or the usual tone within the company. That makes them an easy target, for example for fake messages from the supposed managing director shortly after they start. A short security section in onboarding answers the most important questions:
- How and where do I report a suspicious message?
- How do I set up MFA and the password manager?
- Who is my IT contact, and how do I reach them?
- How do payments, approvals and changes to bank details work here?
- What rules apply to visitors, badges and screen locking?
Reporting culture: reporting must be easy and welcome
A report is the moment when a single phishing attempt can be neutralised for the whole company. For that to happen, reporting must take one click, for example via a report button in the email client. Every report deserves short feedback on whether the message was dangerous or harmless.
How mistakes are handled matters just as much. Anyone who speaks up immediately after a click has done the right thing and deserves recognition, not blame. Our article on how to spot phishing summarises the warning signs your team should know.
Measuring success: reporting rate, not just click rate
Many programmes look only at the click rate in simulations. On its own, however, it says little, because it depends heavily on how difficult the email was. A combination of several metrics, viewed as a trend over several months, is more meaningful:
| Metric | What it shows | What to watch |
|---|---|---|
| Reporting rate | Share of people who report a simulated email | Should rise over time |
| Time to first report | How quickly IT learns about a wave | Crucial for a fast response |
| Click rate | Share of people who click the link | Depends heavily on difficulty |
| Credential entry rate | Share of people who enter credentials | More meaningful than the click alone |
| Real reports | Genuine suspicious messages reported in daily work | Shows whether training reaches everyday work |
Getting started in four steps
- Agree goals, framework and communication with management, the works council and data protection.
- Set up a simple reporting route and make it known to everyone.
- Start with a first simulation as a baseline and short basic modules.
- Offer small units every month, evaluate the metrics every quarter and adjust the content.
It is important that management visibly takes part, because the topic concerns every level. Q-entra supports you with concept and training through cyber security and, if you wish, with ongoing support through managed security, so that training and technical protection fit together.
