What is security awareness training?

Security awareness training teaches employees to recognize and respond to cybersecurity threats such as phishing emails, weak passwords and social engineering. Its goal is everyday behavior change: employees who spot suspicious messages, report them quickly and handle company data safely.

Reviewed by Clark Quinn, Chief Learning Strategist Updated October 28, 2026

Example

A healthcare software company’s security team notices that fewer employees are reporting suspicious emails, even though the number of attacks has not dropped. The annual security course is a 40-minute slide deck that most people click through without reading. L&D and the security team decide to rebuild it together.

The new version is a series of five-minute videos, one per threat. In the phishing module, learners see a realistic email from “IT support” asking them to reset their password, and they choose what to do. A wrong choice plays out what happens after the click. The right choice shows how to use the report button. Monthly phishing simulations follow, and anyone who clicks a simulated link gets a two-minute refresher on the spot.

How it works

Security awareness training is usually owned by the security team, with L&D helping to design and deliver it. Most programs combine a yearly course with ongoing reminders and tests.

Core topics

• Phishing: fake emails, text messages (smishing) and phone calls (vishing) that try to get someone to click a link, open an attachment or share login details.
• Passwords and authentication: long, unique passwords, password managers and multi-factor authentication (MFA).
• Social engineering: someone posing as a manager or supplier with an urgent request, or following an employee through a secure door.
• Data handling: how to classify, share, store and dispose of sensitive information.
• Devices and remote work: software updates, public Wi-Fi, screen locks and what to do about a lost laptop.
• Reporting: how and where to report a suspected incident, and why reporting early helps even after a mistake.

Delivery

A typical program includes:

• An annual course, often assigned through the LMS as part of compliance training
• Short refreshers during the year, often delivered as microlearning
• Regular phishing simulations
• Just-in-time lessons shown to anyone who fails a simulation

Measurement

Completion rates show who took the training, but security teams care more about behavior. The usual measures are how many people click a simulated phishing link, how many report it, and how quickly they report. A falling click rate and a rising report rate are the clearest signs that a program is working.

Why the focus is on behavior

Many attacks do not break through technical defenses. They persuade a person to open the door: to click a link, approve a login request or send a payment. Security awareness training aims to build a few habits rather than technical expertise: pausing before clicking, checking unusual requests through a second channel such as a phone call, and reporting anything suspicious quickly.

Recognizing an attack is a judgment call, so practice works better than rules. A branching scenario lets learners make the wrong choice safely and see what follows, which sticks better than a list of warning signs.

Common mistakes

• Training once a year only. Most of a single annual course has faded long before the next one. Short, frequent reminders keep the habits current.
• Punishing people who click. If failing a simulation leads to blame, employees stop reporting their real mistakes, which is the behavior the program needs most.
• Generic examples. Phishing emails that look nothing like the messages employees get are easy to dismiss. Use the tools, brands and request types your staff see every day.
• The same course for every role. Finance teams see invoice and payment fraud, executives get targeted impersonation, and support teams get fake customer requests. Add role-specific modules for the people attackers target most.
• Measuring completion only. Knowing that everyone finished the course says nothing about whether they spot attacks.

Why it matters for L&D teams

• People are a common target. Phishing and social engineering go after employees directly, so technical controls alone do not cover the risk.
• Evidence for clients and auditors. Client security reviews, audits and certifications often ask for proof that staff are trained.
• Fast-changing content. New scam formats appear constantly, so training needs updates within weeks, not once a year.
• A shared job. Security brings knowledge of the threats; L&D brings the instructional design that turns it into habits people keep.