An annual awareness session is easy to organise, easy to evidence and easy to forget. People attend, tick a box and return to their desks. A few weeks later, the same person who sat through the session may still click the same kind of link.
That is not a failing of the people. It is how learning works. Behaviour changes through repetition, relevance and feedback, and a once-a-year event offers none of them. ISO/IEC 27001:2022 expects awareness, education and training as an ongoing activity (Annex A control 6.3, information security awareness, education and training), which a yearly slide deck is a thin way to meet.
Make it regular and short
Brief, frequent activity beats a long session once a year. A few minutes each month on one topic is easier to absorb and easier to fit into a working day.
Make it relevant to the role
Finance staff face payment fraud. Engineers face credential and code risks. Executives face targeted impersonation. Someone who sees their own risks in the examples pays more attention than someone watching generic content.
Practise, with care
Simulated phishing and similar exercises show how people respond to realistic situations. They work best when they are used to learn, not to punish. If people fear being named, they stop reporting, and reporting is the behaviour you most want.
Make reporting easy and safe
Give people one simple way to report something suspicious, thank them when they do, and do not blame them when they have already clicked. Early reports often stop a small problem becoming a large one. A good programme encourages people to report mistakes early, not hide them out of fear of discipline.
Measure behaviour, not attendance
Completion rates tell you who sat through the content. Better signals include:
- Completion rate: how many people finished the training
- Click rate: how many interacted with simulated malicious content
- Reporting rate: how many reported suspicious messages
- Reporting time: how quickly they reported
- Repeat failure rate: whether the same risky behaviours keep recurring in the same teams
People are one layer, not the whole defence
Awareness should not make employees the organisation’s primary security control. Technology, access restrictions, email protection and incident response must work alongside it.
Consider an organisation where employees consistently completed their annual cybersecurity awareness training, but suspicious emails were rarely reported. The organisation introduced short monthly awareness sessions, role-specific phishing simulations and a simple process for reporting suspicious messages. Rather than focusing on who clicked a simulated phishing link, the security team used the results to identify knowledge gaps and provide targeted guidance. Over time, the organisation could measure whether reporting behaviour improved, rather than relying solely on training completion records.
