Security awareness training (SAT) is an ongoing program that teaches employees to recognize, avoid and report cyber threats in their everyday work. It typically combines short training modules with simulated phishing emails, so people practise spotting attacks safely and learn from mistakes immediately. Good programs measure behavior, such as how many people report a suspicious message, not just who completed a course.
At a glance
- SAT combines short training content with simulated phishing and other social-engineering tests.
- It covers phishing, payment fraud, password and MFA habits, data handling and how to report incidents.
- It is often required by cyber insurers, auditors and regulations that ask for staff training.
- The most useful measure is how often and how quickly people report suspicious messages.
- It is usually sold per user per year, sometimes bundled with email security.
What problem it solves
Many attacks start with a person, not a technical flaw: a phishing email that captures a password, a phone call pretending to be the help desk, or a fake invoice from a “supplier.” Technical controls catch a lot, but attackers design messages to slip past them, and one successful click or payment can lead to ransomware or a large financial loss.
Annual slide-deck training rarely changes behavior. People forget it, and it doesn’t reflect the attacks they actually see. SAT replaces that with frequent, short, practical training and realistic practice, so recognizing and reporting a suspicious message becomes a habit. It also gives the business evidence for insurers, auditors and customers that staff are trained.
How it works
Training content. Platforms offer libraries of short videos, interactive modules and quizzes on topics such as phishing, business email compromise, passwords and MFA, safe handling of sensitive data, remote working and the safe use of AI tools. Content can be assigned by role, so finance staff get more on payment fraud and administrators more on privileged access.
Phishing simulations. The platform sends realistic test emails to employees. Someone who clicks or enters credentials sees an immediate explanation and may be assigned a short lesson. Some platforms also simulate SMS and voice phishing. Simulations need to be allowed through your email filtering, which the vendor will explain how to configure.
Reporting. A report button in the email client lets users flag suspicious messages. Reports of simulations are counted as successes; reports of real messages go to IT or the security team, and some platforms help triage them.
Measurement. Dashboards track completion, click rates, report rates, repeat clickers and trends over time. Many platforms integrate with your directory so new hires are enrolled automatically and leavers are removed.
When it matters for buyers
- When cyber insurance renews. Insurers frequently ask whether staff receive training and phishing tests.
- When a compliance framework applies. Many security frameworks and regulations expect documented security training; check the specific requirement that applies to you.
- After a phishing incident or payment fraud. Including when a peer or supplier is hit.
- When the current program is a once-a-year video. Moving to continuous training is often the biggest improvement.
- When onboarding many new staff. Rapid hiring or an acquisition brings in people unfamiliar with your processes.
Questions to ask vendors
- How large and how current is the content library, and is it available in the languages our staff speak?
- Can we assign training by role and automate enrolment from our directory?
- What kinds of simulations do you support (email, SMS, voice), and how are templates kept realistic?
- Does the report button work in our email clients and on mobile, and what happens to real reported messages?
- Which metrics do you report, and can we export them for auditors and insurers?
- Can we customize content with our own policies and branding?
- Is the platform self-run or delivered as a managed service, and who builds and runs the campaigns?
- How is it priced, and is it bundled with email security?
How it differs from a secure email gateway
A secure email gateway (SEG) is a technical control that filters malicious email before it reaches people. Security awareness training prepares people for the messages that get through anyway and teaches them to report those messages so the security team can act. The two work together, and some vendors sell them as a bundle. For curricula, simulation strategies and metrics, see our Security Awareness Training guide.
Problems this helps with
- Employees clicking on phishing emails
- Cyber insurer or auditor requiring proof of staff training
- Staff not reporting suspicious emails or calls
- Annual compliance training that nobody remembers
