Choosing security awareness training

What it is

Security awareness training teaches employees to recognize and report the attacks that reach them directly: phishing email, fake login pages, payment fraud, malicious attachments and phone or text-message scams. Technical controls catch a lot, but some attacks will always land in an inbox, and the person reading it is the last check.

Products in this category fall into a few types:

• Training content libraries provide short videos, modules and quizzes on topics such as phishing, passwords, data handling and remote work. Some cover compliance topics required by HIPAA (the Health Insurance Portability and Accountability Act) or PCI DSS (the Payment Card Industry Data Security Standard).
• Phishing simulation tools send realistic test emails, track who clicks or reports them, and assign follow-up training.
• Human risk platforms combine training and simulation results with signals from other security tools to estimate which people or teams carry the most risk, and target training accordingly.
• Bundled offerings come as part of a managed security service, an email security product or a compliance platform.

Training reduces risk; it does not remove it. Plan for the case where someone clicks anyway, and make sure your other controls (multi-factor authentication, email filtering, endpoint protection) assume that will happen.

Signs you need it

• A customer contract, cyber insurance application or audit asks you to show annual security training.
• Employees have fallen for a phishing email, a fake invoice or an urgent payment request from a "manager".
• Your help desk keeps seeing the same questions about suspicious messages, or worse, sees none at all.
• You have no reliable way for people to report a suspicious email, or reports go to one person's inbox.
• New hires get system access before anyone explains basic security expectations.
• Your current training is one long annual video that people click through without watching.

What to look for

• Short, current content. Brief modules that reflect real attacks hold attention better than an annual marathon.
• Realistic, adjustable simulations. Templates should resemble what your staff actually receive, with difficulty you can tune.
• A one-click report button. Reporting is the behavior you most want, and it should work in your email client and on mobile.
• Integration with your identity and email systems. Automatic user sync keeps enrollment accurate as people join and leave.
• Role-based assignment. Finance, executives and IT administrators face different attacks and need different training.
• Useful reporting. Look for report rates and trends over time, not only click rates, plus evidence you can hand to an auditor.
• Accessibility and language support. Training only works if everyone can actually take it.

Mistakes to avoid

• Running "gotcha" simulations designed to trick as many people as possible. That damages trust and discourages reporting.
• Publicly shaming or punishing people who click. Those who fear consequences stop reporting their mistakes, which is when you most need to hear about them.
• Measuring success only by click rate. A falling click rate can simply mean easier templates; rising reports are a better sign.
• Forgetting to allowlist simulations with your email security tools, which can skew results or block tests entirely.
• Treating training as a compliance checkbox done once a year. Habits form through regular, short reinforcement.
• Skipping leadership. Executives are frequent targets and set the tone for everyone else.

Questions to ask vendors

• How often is content updated, and how do you reflect new attack types?
• Can we create our own simulation templates and landing pages, including ones based on real messages we have received?
• How does the report button work across desktop, web and mobile email clients?
• How do you sync users and groups from our identity provider?
• What does your reporting show beyond click rates, and can we export it for auditors?
• What happens automatically when someone clicks a simulation, and can we change that?
• How do you handle employees who do not use email much, such as field or shop-floor staff?
• What data do you collect about our employees, and where is it stored?

What drives the cost

Most products are priced per user, with tiers based on the size of the content library, simulation features and reporting depth. Human risk features and integrations with other security tools usually sit in higher tiers. Bundling with an email security or managed service product can change the math, so compare what you already own before buying separately. The bigger cost is effort: someone has to plan the calendar, review simulation results, follow up with people who need help and keep the program from going stale. Employee time spent in training is a real cost too, which is one more reason to favor short, relevant modules over long ones.

Where Tabor Point can help

Tabor Point offers policies and security awareness training: security policies that match how you actually operate, awareness training for your staff, and review of the security terms in your customer contracts so you know what you have committed to. If you want a second opinion before you buy, Tabor Point can help.