Building a security awareness program that changes behaviour
An annual video and a quiz do not change what people do when a convincing email arrives at 4:55 p.m. on a Friday. Short, role-based, regular training, with careful phishing simulations and a reporting culture, does.
Reviewed by the ITRS security team · Last updated
Why annual videos don't work
Most attacks on small and mid-sized organizations still start with a person: a phishing email, a fake sign-in page, a call from 'IT support', an invoice with new banking details. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations include employee awareness training for this reason, and the Govern and Protect functions of the NIST Cybersecurity Framework 2.0 both treat awareness as part of managing risk.
The problem is format. A once-a-year compliance video is forgotten within weeks, is the same for the receptionist and the CFO, and measures attendance rather than behaviour. Effective programs are short, frequent, relevant to each role and measured by what people actually do.
Role-based topics
| Group | Focus on |
|---|---|
Everyone | Spotting phishing, reporting quickly, MFA prompts they did not request, safe file sharing, lost devices |
Finance and payroll | Changed banking details, urgent payment requests, payroll diversion, callback verification |
Executives and their assistants | Impersonation of executives, deepfake voice and video requests, travel and public profile risks |
IT and admins | Admin account hygiene, social engineering of the help desk, approving app consents |
Client-facing staff | Client data handling, sending to the wrong person, verifying callers |
New hires | The basics in week one, before they are trusted with access |
Phishing simulations: do's and don'ts
Simulated phishing emails are useful when they teach and harmful when they trap. Get Cyber Safe, the Government of Canada's public awareness campaign, focuses on helping people recognize and report phishing, and that is the right goal for simulations too.
- Do vary difficulty and themes, including ones that mirror real attacks on your sector
- Do give immediate, short teaching when someone clicks, not a reprimand
- Do measure reporting rate, not just click rate
- Don't use lures that cause real distress, such as fake layoffs, bonuses or health scares
- Don't name and shame individuals publicly
- Don't run simulations so often that people stop reading their email
Reporting culture
The single most valuable behaviour is fast reporting. An employee who clicks a link and reports it in five minutes gives you a chance to reset a password and check for mailbox rules before damage is done. An employee afraid of getting in trouble stays quiet for days.
Make reporting one click (a report button in Outlook or Gmail), thank people who report, including false alarms, and tell staff about real attacks that were caught because someone spoke up.
Measuring progress
- Reporting rate on simulations and real phishing, and time to report
- Click and credential-entry rates by role, trended over time
- Completion of short modules, as a hygiene measure only
- Real incidents with a human element, and whether they were reported promptly
- Finance exceptions: payment changes processed without the callback step
Awareness program questions
Five to fifteen minutes for regular modules, and up to an hour for role-specific sessions such as finance and executives. Short and frequent beats long and annual.
Not for occasional clicks. Discipline reduces reporting, which is the behaviour you most need. Repeated disregard of clear procedures, such as skipping payment callbacks, is a management issue handled separately from simulations.
Many insurance applications ask whether staff receive security awareness training and phishing testing. Keep records of what was delivered and when, so you can answer accurately.
Yes, for most of it. The ingredients are a simulation tool, a few short modules, a report button and someone who owns the calendar. Outside help is most useful for the first year's design and for role-specific sessions.
A 12-month plan
We build and run awareness programs alongside the technical controls, so that training and settings tell staff the same story.
Month 1
Baseline simulation; add a report-phish button; ten-minute all-staff session on reporting.
Months 2-3
Finance and payroll session on payment fraud and callback verification; executive briefing on impersonation and deepfakes.
Months 4-6
Monthly five-minute modules; simulations every four to six weeks; admin-specific session.
Months 7-9
Tabletop exercise with managers; refresh new-hire module; review metrics.
Months 10-12
Repeat the baseline simulation, compare results, adjust topics for next year.
Related reading.
- ArticleHow to Stop Phishing Attacks: Email Security and Employee TrainingThe specific Microsoft 365 settings, sign-in rules and staff habits that stop most phishing at small and mid-sized businesses, and what to do when someone clicks anyway.
- GuideA payment verification procedure to stop wire fraudMost payment fraud is not a technical failure. It is a convincing request that skips a step.
- GuideDeepfake voice and video fraud against businessesFraudsters can now clone an executive's voice from a few public clips and appear as familiar colleagues on a video call.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.