How to Run Security Awareness Training That Sticks

Most security training fails the same way. Once a year, everyone clicks through a 45-minute video, answers 10 multiple-choice questions and forgets it all by lunch. Then a convincing fake invoice lands in someone’s inbox in March, and the training never comes to mind.

Training that works looks different. It’s short, frequent, practical and tied to the messages your people actually receive. The US Cybersecurity and Infrastructure Security Agency (CISA) puts it plainly in its small business guidance: threats evolve constantly, so once-a-year training isn’t enough. This guide gives you a year-round plan you can run yourself, including monthly lessons, phishing simulations and the few metrics that matter.

Why security awareness training matters

Attackers often find it easier to trick a person than to break software. Phishing emails, fake login pages, phone calls pretending to be IT support and requests to change a vendor’s bank details all target people, not machines. CISA notes that phishing attacks are frequently preventable when employees are trained to recognize and avoid suspicious messages.

The money at stake is real. The FBI’s Internet Crime Complaint Center reported about $3.05 billion in losses from business email compromise in 2025, one of the largest categories in its annual report. Many of those scams depend on an employee believing a fake request and acting on it.

Training is also required in some industries:

• FTC Safeguards Rule (16 CFR 314.4(e)): covered financial institutions, which include many tax preparers, auto dealers and lenders, must provide personnel with security awareness training that’s updated as necessary.
• HIPAA Security Rule (45 CFR 164.308(a)(5)): covered entities and business associates must implement a security awareness and training program for all workforce members, including management.
• PCI DSS: businesses that handle payment cards have security awareness requirements under the card industry’s data security standard.

This is not legal advice. Check which rules apply to your business.

What makes training stick

NIST’s guidance on learning programs (SP 800-50 Revision 1, published in September 2024) treats training as a life cycle you keep improving, not a one-time event. In practice, programs that change behavior share 6 traits:

1. Short and frequent. 5 to 10 minutes a month beats an hour once a year.
2. Relevant. Use examples that look like the email, texts and calls your staff actually get.
3. Practical. Teach specific actions: hover over links, check the sender, call back on a known number.
4. Practiced. Simulated phishing gives people safe repetitions.
5. Blame-free. People who fear punishment hide mistakes. People who feel safe report them fast.
6. Led from the top. When the owner or manager reports a phishing email in front of the team, everyone else follows.

Key takeaway: The goal isn’t zero clicks. The goal is fast reporting. An employee who clicks and reports within minutes gives you a chance to contain the damage. An employee who clicks and stays quiet gives the attacker hours.

A 12-month training calendar

Use this calendar as a starting point. Each lesson should take 5 to 10 minutes, delivered as a short video, a team huddle, a one-page handout or a quick quiz. Swap months around to match your busy seasons and current threats.

For the August lesson, our guide on writing an AI acceptable use policy gives you the rules to teach. For September, see how to spot a deepfake.

How to run phishing simulations the right way

Phishing simulations are fake phishing emails you send to your own staff to practice spotting real ones. Done well, they build reflexes. Done badly, they build resentment.

Step 1: Tell people it’s happening

Announce that the company will run practice phishing emails throughout the year. You don’t need to say when. Transparency turns the program into a skill-building exercise instead of a trap.

Step 2: Set up a report button

Make reporting a one-click action. Microsoft 365 and Google Workspace both offer built-in ways to report phishing, and most simulation platforms add a report button to email. If you don’t have a button, set up a simple rule: forward suspicious messages to one address and delete them.

Step 3: Run a baseline test

Send one realistic simulation to everyone to see where you’re starting. Don’t announce results by name.

Step 4: Simulate monthly or quarterly

Vary the lures: package delivery, shared document, password expiry, invoice, voicemail. Match difficulty to your team. Start with obvious clues and get subtler as people improve.

Step 5: Teach at the moment of the click

When someone clicks a simulation, show them a short page explaining the clues they missed. That moment, when the mistake is fresh, is when learning sticks.

Step 6: Avoid cruel lures

Skip simulations that promise bonuses, raises or emergencies involving family. They may be realistic, but they damage trust in leadership and make people resent the program.

Step 7: Celebrate reporters

Thank people who report, both for simulations and real attacks. A monthly shout-out for the fastest reporter costs nothing and builds the habit.

Our guide on how to spot phishing emails has annotated examples you can use as lesson material.

Choosing training tools

You can run a program with free materials or with a paid platform. Here’s how the options compare.

Training platforms are typically priced per user per year. Ask vendors whether simulations, reporting dashboards and completion certificates for compliance are included in the base price.

Measure what matters

Track a few simple numbers each quarter:

• Report rate: the percentage of employees who report a simulated phishing email. This is your most important number. You want it to rise.
• Click rate: the percentage who click a simulated link. You want it to fall, but don’t obsess over it; harder simulations will raise it.
• Time to first report: how quickly someone reports a real or simulated phish. Faster is better.
• Training completion: who has finished the monthly lessons. This matters for compliance records.
• Real reports: the number of genuine suspicious messages staff report. Rising numbers usually mean awareness is working, not that attacks are increasing.

Keep completion records with dates. If you’re subject to the FTC Safeguards Rule or HIPAA, documentation shows regulators and auditors that training happened.

Where to start this month

1. Pick an owner. Assign one person to run the program and track new threats, as CISA recommends.
2. Write a 1-paragraph policy. Explain that training is monthly, simulations will happen and reporting is always safe.
3. Set up reporting. Add a report button or a single forwarding address.
4. Deliver lesson 1. Use the phishing red flags lesson and real examples from your own inbox.
5. Run your baseline simulation. Record report and click rates.
6. Put the calendar in everyone’s diary. A recurring 10-minute slot each month keeps the program alive.
7. Close the loop with technology. Make sure MFA is on everywhere using our two-factor authentication guide, so a single mistake doesn’t become a breach.

Once training is running, fold it into your broader small business cybersecurity checklist.

Conclusion

Security awareness training sticks when it becomes a habit rather than an annual chore. Keep lessons short and monthly, practice with fair phishing simulations, make reporting effortless and celebrate the people who speak up. Measure report rates, keep records and update topics as threats change. Your employees can be your fastest alarm system. Give them the skills and the confidence to sound it.

Sources

• CISA: Teach Employees to Avoid Phishing — ongoing training, red flags, reporting and verification
• NIST: SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program — life cycle approach to training programs
• 16 CFR 314.4, FTC Safeguards Rule elements (Cornell LII) — security awareness training requirement for covered financial institutions
• 45 CFR 164.308, HIPAA administrative safeguards (eCFR) — security awareness and training standard
• FBI IC3: 2025 Internet Crime Report — business email compromise losses in 2025