Security awareness has a reputation problem, and it earned it honestly. The classic format – one hour, once a year, narrated by a stock-photo office and a voiceover that has never met a human – produces exactly one reliable outcome: a completion certificate. People finish the module, pass the quiz, and forget all of it by lunch.
That's not a willpower failure. It's a design failure. We've known how memory and behaviour change work for a century; security training mostly ignores it. Here's what landing the message actually requires.
Make it about their jobLink to this section
A generic phishing slide doesn't land with the finance team, the legal team, or the people on the warehouse floor – because none of them recognise their own world in it. Role-based scenarios do. Show finance an invoice-redirection scam, show legal a malicious "contract for review," show frontline staff the QR-code sticker slapped over the real one.
People don't protect abstractions. They protect the thing in front of them that they recognise.
Shorter, and spaced outLink to this section
Fifteen focused minutes once a quarter comfortably beats a one-hour annual slog, and it isn't close. Forgetting is a curve, not a cliff: we lose most of what we learn within days unless something brings it back. Repetition at intervals is how knowledge moves from "I saw a slide once" to "I just did the safe thing without thinking." Treat it as spacing, not as a willpower test.
Test to teach, not to trapLink to this section
Simulated phishing is a fantastic tool and a terrible weapon. The moment a simulation feels like a trap designed to humiliate, two things happen: people stop trusting the security team, and they stop reporting real incidents for fear of looking stupid. Run simulations that teach – share aggregate results, explain the tells in the moment, and celebrate the people who reported it.
Teach the newest skill: using AI safelyLink to this section
This is the gap most programmes haven't caught up to. Your people are already using AI tools every day, and almost none of them have been told where the edges are. What's safe to paste into a public chatbot and what absolutely isn't? How do you spot a confidently wrong answer? Why does "the AI wrote it" not transfer the responsibility off the human?
Folding safe-AI habits into your awareness training does two jobs at once: it closes a real and growing risk, and it makes the training feel current instead of like a relic. Nothing signals "this matters now" quite like addressing the tool everyone actually has open.
Measure behaviour, not attendanceLink to this section
Completion percentage measures compliance with HR, not security. Track the numbers that reflect what people do:
- Phishing reporting rate (not just click rate)
- Repeat-click trends over time
- How fast suspicious activity gets reported
- Whether risky behaviours drop after an intervention
A trained workforce reports the weird email. An untrained one hides the mistake and hopes. That single difference is the whole return on the programme.
Keep the conversation aliveLink to this section
The module is the smallest part. A quick reminder when a real scam is going around, a five-minute "here's what almost got us" at the team meeting, a leader who mentions security without being asked – those do more for culture than any SCORM file ever will. Awareness isn't an event you complete. It's a habit you keep warm.