What is phishing awareness training?

Phishing awareness training is a structured programme that teaches employees to recognise, verify, report and recover from phishing across email, SMS, voice, QR codes and collaboration tools. It is distinct from a phishing simulation, which is an authorised test that measures how people actually respond. Effective programmes run both and use simulation results to shape training content.

How often should employees receive phishing training?

Short modules monthly, a deeper role-based module quarterly, a session during onboarding before mailbox access, and event-driven refreshers after real incidents or new techniques. An annual attestation on top satisfies auditors but is not the programme. Spaced repetition beats a single long annual course.

Is phishing training mandatory under NIS2?

NIS2 does not name phishing training specifically, but Article 21(2)(g) lists cybersecurity training and basic cyber hygiene as a required risk-management measure, and Article 20(2) requires management bodies to follow training and offer it to employees regularly. For almost every in-scope entity, a documented phishing training programme is the practical way to evidence both.

What is a good phishing click rate?

There is no universal good number, because click rate depends on how hard the lure was. A 3 percent click rate on an obvious lure is weaker than 15 percent on a targeted one. Track report rate, time to first report and credential submission rate alongside click rate, and compare each campaign only with campaigns of the same difficulty.

Should employees who click be disciplined?

No. Disciplining clickers teaches people to hide clicks, which destroys the reporting behaviour that protects the organisation. Repeat clickers should receive coaching and role-relevant content. Results should never enter personnel files, and this should be agreed with HR and, in the Netherlands, the works council before the first campaign.

What is the difference between phishing training and security awareness training?

Security awareness training is the umbrella programme covering all human-factor risks: passwords and MFA, data handling, physical security, remote work, incident reporting and phishing. Phishing training is the phishing-specific component, usually the largest, because phishing is the most common initial access route. This article covers the component; our security awareness training guide covers the programme.

Do we still need phishing training if we have a good email filter?

Yes. Filters stop the bulk, but the targeted messages that cause incidents are designed to pass them, and voice, SMS, QR and collaboration-tool lures bypass email filtering entirely. Trained employees who report are the detection layer for everything the filter misses, and their reports improve the filter.

1 November 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)

Phishing training for employees: what actually changes behaviour, and how to run it

Most organisations already run phishing training. Far fewer can show that it changed what people do when a convincing email lands at 16:55 on a Friday. This guide covers what effective phishing training for employees contains, how often to run it, which metrics prove it works, and where NIS2, ISO 27001 and DORA fit.

Measure your training with a simulation

What phishing awareness training is, and what it is not

Phishing awareness training is a structured programme that teaches employees to recognise, verify, report and recover from phishing attempts across email, SMS, voice calls, QR codes and collaboration tools. It is a learning instrument. A phishing simulation is a measurement instrument: a controlled, authorised test that shows how the organisation actually behaves when a credible lure arrives. The two are often sold as one product, but they answer different questions. Training asks whether people know what to do; simulation asks whether they do it.

That distinction matters for how you buy and how you judge results. A programme that is all simulation produces a click-rate graph and little else. A programme that is all training produces completion certificates and no evidence of behaviour. The organisations that reduce phishing risk run both, with training content shaped by what the simulations and the real incident queue reveal.

This article covers the training side: content, cadence, the report button, metrics, role-based modules and the regulatory hooks. For the measurement side, see our phishing simulation service and the companion guide on how to run a phishing campaign.

Why annual phishing training alone fails

Phishing remains the most common initial access route in the breach data that matters. Verizon's Data Breach Investigations Report has for years attributed the majority of breaches to a human element, with phishing and stolen credentials at the top of the list, and the ENISA Threat Landscape places phishing among the leading initial access vectors every year. None of that is news to a security team. What is less discussed is why the training most organisations already run does so little about it.

The first reason is cadence. A 45-minute module once a year, taken to satisfy an auditor, is forgotten within weeks. Research on spaced repetition is unambiguous: short, repeated exposure beats a single long session. The second is content. Generic modules teach people to look for spelling mistakes and odd greetings, cues that modern, AI-assisted phishing no longer offers. The third is the metric. Programmes managed on click rate alone drift towards easier lures and a culture of catching people out, which produces the behaviour you least want: employees hiding a click rather than reporting it.

The fourth reason is the missing second half. Recognising a phish is worth little if the employee does not know where to report it, receives no feedback when they do, and fears consequences if they clicked first. Training that stops at recognition trains spectators. Training that builds a reporting reflex produces sensors for your security operations centre.

What good phishing training contains: recognise, verify, report, recover

Six components, each with a measurable outcome. If a vendor's content is missing one, that is the gap in your programme.

Recognise the cues that still work

Not spelling errors. Teach the structural cues an attacker cannot remove: unexpected urgency, a request to change payment or login details, a sender that does not fit the context, a link that resolves to a domain the organisation does not own, an MFA prompt nobody initiated, a request to approve an application's access. Use the organisation's real lures, anonymised, as the examples.

Verify out of band

The single most protective habit: confirm any request involving money, credentials or access through a second channel the requester did not supply. A known phone number, a walk to the desk, a ticket in the service desk. Training should make this normal and expected, so the finance clerk who calls the CFO back is praised rather than inconvenienced.

Report with one click

The report button in the mail client, how to use it, what happens afterwards, and that reporting after a click is still the right move. Reporting is the behaviour that turns employees from targets into detection. Every module should end at the button.

Recover without shame

What to do in the first ten minutes after clicking or entering credentials: call the service desk, change the password from a known-good device, expect and welcome the follow-up. The sooner the report, the smaller the blast radius. Training must state explicitly that nobody is punished for reporting.

Modern and AI-assisted threats

Deepfake voice calls from the 'CEO', QR codes on invoices and parking meters, OAuth consent prompts that grant a rogue application mailbox access, MFA fatigue pushes, lures inside Teams and Slack. These are the 2026 threats; a programme still centred on badly spelled lottery emails is a decade behind.

Role and context

A finance team, an HR team, a service desk and an executive office face different lures and hold different keys. One generic module for all of them wastes attention. The role-based section below sets out what each group needs.

Cadence: how often phishing training should run

The right cadence is frequent, short and tied to events, with an annual attestation layered on top for the auditor.

Onboarding: within the first week

New employees are the most targeted and the least able to judge what is normal. A 15-minute module before or on the day mailbox access is granted, with the report button demonstrated live, is the highest-return session in the whole programme.

Baseline measurement in month one

Before the first training wave, run an authorised baseline simulation so you know where you start. Without it, every later number is unanchored and the board has nothing to compare against.

Monthly micro-content: three to five minutes

A short scenario, one cue, one action. Delivered in the mail client or on the intranet, not in a learning portal that needs a separate login. Monthly keeps the material in working memory; quarterly is the floor.

Quarterly deeper module by role

Twenty minutes on the threats specific to the group: invoice fraud for finance, MFA-reset fraud for the service desk, deepfake voice for executives and their assistants.

Event-driven refreshers

After a real incident in your sector, after a simulation lure that worked, or when a new technique appears, such as a wave of QR phishing or a consent-phishing campaign against Microsoft 365 tenants. Relevance is the strongest driver of attention.

Annual attestation

A tracked completion for the auditor, mapped to the controls listed further down. Keep it short. It is evidence, not the programme.

The report button is the most important control in the programme

If you change one thing after reading this, make it this. A one-click report button in Outlook, Gmail or the mobile mail client, routed to a mailbox the security team actually triages, turns every trained employee into a sensor. Organisations with a working report path routinely detect campaigns from the first few reports, minutes after delivery and long before a filter update arrives.

A report path needs four things to work. The button must be present on every client, including mobile. Triage must have a service level: an acknowledgement within minutes, a verdict within hours. The reporter must receive feedback, even a template ('Thank you, this was malicious, we have blocked it'), because unanswered reports stop within a quarter. And the output must feed detection: reported indicators should reach your secure email gateway, your endpoint tooling and your SOC or MDR provider, so that one report protects everyone who did not click.

The same button should receive simulation reports. If an employee reports a simulated lure, the response should congratulate them and tell them it was a test. That closes the loop between training and measurement in a way no dashboard can.

Metrics: the numbers that prove phishing training works

Click rate is the metric everyone tracks and the least useful on its own. Run these together, always with the lure's difficulty level attached.

Metric	What it tells you	What it hides	Direction
Click rate	Share of recipients who clicked the simulated link	Depends entirely on lure difficulty; a low number can mean an easy lure, not a trained workforce	Down, read against difficulty level
Report rate	Share who reported the lure, clicked or not	Nothing, once the button is in place; this is the behaviour you want	Up; in mature programmes reports outnumber clicks several times over
Report-before-click	Whether the first report arrived before the first click	The reaction speed of your human sensor network	Up
Time to first report	Minutes from delivery to the first report	Whether the SOC could have contained a real campaign	Down, towards single-digit minutes
Credential submission rate	Share who entered credentials on the landing page	The true impact metric; a click is noise, a password is an incident	Down
Repeat clickers	Individuals who click across several campaigns	A coaching signal, never a disciplinary list	Down, through targeted coaching
Training completion	Who finished the module	Says nothing about behaviour; the auditor's metric, not yours	Complete, then move on

Role-based phishing training: finance, HR, IT administrators, executives

Attackers segment their targets. Training should too. Four groups carry disproportionate risk and need their own material.

Finance and accounts payable

Invoice fraud, payment detail changes, supplier impersonation and business email compromise. Training should cover the verification procedure for any change to bank details, the four-eyes rule on payments, and the pattern of a 'CFO' asking for an urgent confidential transfer. Our free module on business email compromise covers the attacker's playbook in detail.

HR and recruiting

CVs and portfolios as malware carriers, payroll diversion requests from 'employees' asking to change their bank account, and lures built around job applications. HR also holds the personal data attackers want for the next pretext, which makes data-handling part of the module.

IT administrators and the service desk

MFA-reset and password-reset fraud over the phone, OAuth consent requests for 'productivity apps', lures aimed at privileged accounts, and social engineering of the service desk itself. This group needs a verification script for identity resets, not a general module.

Executives and executive assistants

Whaling, deepfake voice and video calls, requests timed to travel, and the assistant as the path to the principal. Executives also approve budgets and should understand why the programme does not punish clickers. Our deepfake voice phishing module is written for this audience.

Everyone else

Microsoft 365 login lures, shared-document notifications, QR codes, delivery notices and messages inside Teams or Slack. Short, frequent, and always ending at the report button.

Simulation as the measurement instrument

Training tells you what people have been shown. Only a simulation tells you what they do. An authorised phishing simulation, scoped with legal and HR, built on current attacker tradecraft and followed by a teaching moment rather than a reprimand, is how you measure whether the content above is landing. The results also feed back: the lures that worked become next quarter's training examples.

HackersHub runs phishing simulation as a managed service for organisations that want the measurement done by practitioners who see real campaigns, with pretexts built from current threat intelligence and reporting written for the board. If you plan to run one yourself, the companion guide on how to run a phishing campaign covers scope, legal groundwork, pretext ethics, allow-listing and what not to do.

Have the measurement done by practitioners

Regulatory hooks: NIS2, ISO 27001, DORA and the others

None of these texts prescribes a vendor or a format, but each expects evidence that staff are trained and that the training covers the threats you face. Map your programme to them once and the audit question answers itself.

NIS2, Article 21(2)(g): basic cyber hygiene practices and cybersecurity training are a named risk-management measure; Article 20(2) additionally requires management bodies to follow training and to offer similar training to employees on a regular basis. In the Netherlands this arrives through the Cyberbeveiligingswet.
ISO/IEC 27001:2022, Annex A control 6.3: personnel receive appropriate information security awareness, education and training, with regular updates relevant to their job function. Auditors look for role-relevance and regularity, not a single annual module.
DORA, Article 13(6): financial entities must develop ICT security awareness programmes and digital operational resilience training as compulsory modules for all staff and senior management, with complexity commensurate to their role.
GDPR, Article 39(1)(b): the data protection officer's tasks include awareness-raising and training of staff involved in processing. Phishing training that covers data-handling lures supports this task directly.
PCI DSS v4.0.1, Requirement 12.6: a formal security awareness programme, with training on hire and at least once every 12 months, covering threats that could affect cardholder data, including phishing and social engineering.
Sector baselines: NEN 7510 for Dutch healthcare and the BIO for Dutch government inherit the ISO 27001 awareness control. A role-based phishing programme satisfies all of them with one set of evidence.

Build, buy, or start with the free library

You have three routes. Building content in-house gives full relevance but needs a writer who follows threat developments and a sponsor who protects the time. Buying a platform gives cadence and tracking out of the box, at the cost of generic content and a per-user licence that grows with headcount. The third route, increasingly common, is to use open, practitioner-written material for the content and spend the money on measurement and on the roles that need bespoke work.

HackersHub publishes a free, open security awareness library, written by the testers who run phishing campaigns against organisations like yours. The phishing cluster covers spear phishing, business email compromise, smishing, vishing, QR phishing, Microsoft 365 and OAuth consent phishing, deepfake voice and phishing in Slack and Teams, each as a short module with an assessment. There is no paywall and no registration. Use it as your monthly micro-content, point the teaching moment of your simulations at it, or borrow its structure for your own material.

For the programme-level view, including behaviour models, topics beyond phishing and a build-versus-buy comparison, see our guide to security awareness training. For organisations that want the measurement done by practitioners, our phishing simulation service is the complement.

Frequently asked questions

Related guides and resources

Want to know whether your phishing training is working?

HackersHub runs authorised phishing simulations built on current attacker tradecraft, with a teaching moment for every click and a report your board can read. Schedule a call with a practitioner.

Scope a phishing simulation Talk to an expert