1 November 2026 · 10 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Security awareness training in 2026: what actually changes behaviour, and how to build a programme that proves it
Most organisations run security awareness training because an auditor asks for it. The ones that get value from it run it because an attacker will test their people whether they train them or not. This guide explains the difference, written by the people who run those tests.
Security awareness training in short
The answers a CISO, compliance lead or HR director usually needs before reading further.
- Security awareness training is a structured, recurring programme that teaches employees to recognise, resist and report the attacks that target people: phishing, voice and deepfake fraud, credential theft, data mishandling and physical intrusion.
- A once-a-year e-learning module satisfies the letter of most frameworks and changes almost nothing. Behaviour changes when knowledge, motivation, ability and timely prompts are designed together and measured.
- The metric that matters is not completion. It is how many people report a suspicious message, how fast, and whether that number rises after each cycle.
- NIS2 Article 21(2)(g), ISO 27001:2022 control A.6.3, DORA Article 13(6), GDPR Article 39(1)(b) and PCI DSS v4.0.1 Requirement 12.6 all expect awareness and training, with evidence that it happened and was reviewed.
- You can build the programme, buy a platform, or start with free practitioner-written material. HackersHub publishes a free security awareness library and runs the phishing simulations that measure whether any of it worked.
What security awareness training is, and what it is not
Security awareness training is the part of an information security programme aimed at people rather than systems. Its job is to make sure every employee, contractor and manager knows which attacks they are likely to face in their role, recognises them in the moment, knows what to do, and does it. In practice it combines short learning content, realistic exercises such as phishing simulations, clear reporting routes and feedback, repeated over the year rather than delivered once.
Three words get used interchangeably and should not be. Awareness is knowing a threat exists: that an invoice can be forged, that a voice on the phone can be synthetic, that a multi-factor prompt you did not trigger is an attack. Training is the ability to act on that knowledge: how to verify a payment change, how to report a message. Culture is what people do when nobody is watching and the policy is inconvenient. A programme that only produces awareness is an information campaign. A programme that produces trained behaviour and a reporting culture is a security control, and the only one standing between an attacker and an employee with payment authority.
It is not a substitute for technical controls. Mail filtering, phishing-resistant multi-factor authentication and detection carry most of the load; awareness training exists for the attacks that get through those layers, fewer than before and far more targeted.
Why compliance-only training fails
The typical programme: a 30-minute e-learning module in January, a completion report in February, a certificate in the audit binder, silence until next year. Completion reaches 95 percent because HR chases the stragglers, and nothing else moves. The programme was designed to produce a completion record, and that is what it produces. The content is generic (the same module for the clerk who approves wire transfers and the supervisor who never opens an attachment), the timing is wrong (memory decays within weeks) and there is no feedback loop, so the next cycle repeats the same module.
The Verizon Data Breach Investigations Report has for years attributed a majority of breaches at least in part to a human element: a credential handed over, a link clicked, a payment redirected. The UK National Cyber Security Centre, in its guidance on defending against phishing, is explicit that users cannot be expected to spot every attack, that reporting must be easy and that nobody should be punished for clicking. The SANS Security Awareness Maturity Model describes the same journey from the inside: programmes start at compliance-focused and only reach behaviour change when they are resourced, role-specific and measured. Most organisations we test sit at the compliance stage and believe they are further along.
The behaviour model behind training that works
Behavioural science gives a simple test for any awareness activity. A behaviour happens when four conditions meet at the same moment. Design for all four or expect none of them.
Knowledge: do they know what the attack looks like today?
Not phishing in general, but the 2026 variants in their inbox: a Microsoft 365 login page on a lookalike domain, a QR code in a parking notice, a voice that sounds exactly like the CFO. Knowledge must be current, role-specific and short enough to retain.
Motivation: do they care enough to act?
Fear campaigns and shaming destroy motivation; people stop reporting to avoid blame. Motivation comes from understanding the consequence to colleagues and customers, from leadership visibly doing the same things, and from seeing that a report is answered.
Ability: is the right action easy?
If reporting takes six steps and a ticket, people delete the message instead. A one-click report button, a two-minute verification procedure for payment changes and a help desk that thanks the caller all raise ability. This is where most programmes under-invest.
Prompts: is there a cue at the moment of decision?
A banner on external mail, a warning when the display name does not match the address, a pop-up before approving an unexpected multi-factor request, a quarterly simulation that lands while the lesson is fresh. Prompts turn knowledge into action at the one moment it counts.
How to design the programme: seven steps
The order matters. Measure first, so that every later step can prove it did something.
1. Establish a baseline
Before any training, run an unannounced phishing simulation and a short knowledge assessment. Record the click rate, the credential-entry rate and, above all, the report rate and time to first report. Without this number the programme cannot show progress to the board or the auditor.
2. Map topics to roles and risk
Finance and procurement get business email compromise and payment verification. Executives and their assistants get deepfake voice and pretexting. IT administrators get multi-factor fatigue, OAuth consent abuse and help-desk social engineering. Everyone gets the foundations. Keep the generic layer small and the role layer sharp.
3. Set a cadence people can sustain
Short touchpoints every four to six weeks outperform one long annual session: a ten-minute module, a two-minute video or a single simulated lure keeps the subject in working memory. Reserve the longer session for onboarding and the annual review most frameworks require.
4. Use simulations as the measuring instrument, not the punishment
Phishing simulations measure whether training changed behaviour and deliver a teaching moment at the point of failure. Vary difficulty, rotate themes, include voice and SMS where the role warrants it, and never use pretexts about bonuses, redundancies or personal matters. A managed phishing simulation gives you baseline and trend without building infrastructure.
5. Make reporting the primary behaviour
Install a report button in the mail client, route reports to a triage queue and close the loop: every reporter hears back the same day. One early report lets the security team pull the same lure from two hundred other inboxes, which is why report rate predicts real-incident outcomes.
6. Involve leadership and the works council early
Executives complete the same modules and simulations, and say so. In the Netherlands and much of the EU, simulations that monitor employee behaviour fall under works council consultation and data protection rules; agree the approach, data retention and no-blame policy before the first campaign, not after a complaint.
7. Review, report and adjust every cycle
Each cycle ends with a one-page report: baseline versus current, by department, with the three topics to emphasise next. This is the evidence your ISO 27001 auditor, NIS2 supervisor or DORA assessor will ask for, and it keeps the sponsor interested.
The topics a 2026 programme must cover
Attack techniques moved faster than most curricula. This is the list we expect in any programme that claims to be current.
Phishing and AI-assisted phishing
Flawless language, lures built from the target's LinkedIn profile, lookalike login pages that steal the session. The old tells are gone: teach verification of the request, not inspection of the grammar.
Deepfake voice and video fraud
A few seconds of conference audio is enough to clone a director's voice. Payment and access requests by phone or video need an out-of-band check through a known number, every time.
Multi-factor fatigue and consent phishing
Attackers holding a password trigger push notifications until someone taps approve, or trick the user into consenting to a malicious application that reads the mailbox. An unexpected prompt is an incident.
Passwords, password managers and passkeys
Reuse across services remains the most common root cause in the breaches we investigate. A password manager, unique credentials per service and passkeys wherever supported remove whole classes of attack.
Data handling and AI tools
Which data may go into a public AI assistant, a personal cloud drive or a messaging app, and which may not. Plain-words classification with examples from the employee's own department beats a policy nobody has read.
Incident reporting and the first ten minutes
What to do after clicking, entering a password or paying the wrong account. Who to call, what not to delete, why speed beats embarrassment. This is where a no-blame culture pays back.
Physical security and tailgating
Badges, visitors, unattended screens, USB devices, the courier who needs the printer. Physical penetration tests show how often a confident stranger reaches the server room; the lesson is to challenge politely and escalate.
Remote and hybrid work
Home networks, public Wi-Fi, personal devices, shared screens on video calls, printed documents at home. The perimeter is the laptop and the person holding it.
Metrics that matter, and the ones that mislead
Boards and auditors will accept whatever you report. Report the numbers that predict incidents.
| Metric | What it actually tells you | The trap |
|---|---|---|
| Completion rate | Whether HR chased people effectively | Treated as proof of competence; it proves attendance |
| Quiz score | Short-term recall on the day | Decays within weeks; says nothing about behaviour under pressure |
| Simulation click rate | Susceptibility to one lure on one day | A falling click rate may only mean easier lures |
| Report rate | Whether people recognise and act; predicts real-incident outcomes | Stays near zero without a report button and a feedback loop |
| Time to first report | How long the security team has to contain a real campaign | Only meaningful if reports are triaged in near real time |
| Repeat-click population | Who needs role-specific coaching, not another module | Used for discipline instead of support, which kills reporting |
Compliance hooks: what each framework asks for
Every major framework names awareness and training. The wording differs; the evidence an assessor wants is almost identical: a programme, proof it ran, proof it was reviewed.
| Framework | Requirement | Evidence that satisfies an assessor |
|---|---|---|
| NIS2, Article 21(2)(g) | Basic cyber hygiene practices and cybersecurity training as part of the risk-management measures | Documented programme for all staff, completion and simulation records, management-body training per Article 20(2) |
| ISO 27001:2022, Annex A control 6.3 | Information security awareness, education and training appropriate to role, regularly updated | Training needs by role, delivery records, campaign evidence, effectiveness review |
| DORA, Article 13(6) | ICT security awareness programmes and resilience training as compulsory modules for all staff and senior management | Module records including the management body, content aligned to the entity's ICT risk, periodic review |
| GDPR, Article 39(1)(b) | The data protection officer monitors compliance including awareness-raising and training of staff involved in processing | DPO training plan, attendance by processing role, documented awareness activities |
| PCI DSS v4.0.1, Requirement 12.6 | Formal programme reviewed at least every 12 months, training on hire and at least annually, covering phishing and social engineering, with acknowledgement | Programme document, annual review minutes, completion and acknowledgement records |
Build, buy or start free
Three honest routes. Most mature programmes end up combining them.
| Route | Fits when | Watch out for |
|---|---|---|
| Build in-house | You have a security team with time, strong internal communications and a specific culture to address | Content goes stale; nobody owns the metrics; simulations need infrastructure and legal groundwork |
| Buy a platform | You need role-based content in several languages, automated assignment and audit reporting at scale | Licence cost scales with headcount; generic libraries; the vendor's click rate is not your report rate |
| Free practitioner content plus a managed simulation | You want current, expert-written material without a procurement cycle, and an independent measurement of behaviour | You still own cadence, reporting and the works-council conversation |
The free route, and where HackersHub fits
HackersHub publishes a free security awareness library, written by the testers who run phishing simulations and red team engagements for enterprise clients. No paywall, no registration, updated as techniques change. It exists because we kept walking into organisations that had paid for an annual module and had never heard of the attacks we used to get in.
The measurement side is where we come in as a service. Our phishing simulations give you the baseline, the quarterly trend, the report rate and the teaching moment, run by hands-on experts rather than a template engine, with the legal and works-council groundwork handled before the first email goes out. Where the risk warrants it, social engineering testing extends the exercise to voice, SMS and on-site pretexting. Ten years of offensive security and a 4.9/5 rating across 127 reviews come from exactly that: finding the gap before someone else does.
Frequently asked questions
Related reading
- Phishing simulation services by HackersHub
- Free security awareness library
- Phishing awareness training for employees: what works
- How to run a phishing simulation campaign step by step
- What does a phishing simulation cost? Pricing models explained
- What is social engineering? Techniques and defences
- Social engineering testing: voice, SMS and on-site
- Penetration testing services by HackersHub
Find out whether your training changed anything
A baseline phishing simulation tells you where your people stand today, with the report rate and the teaching moment built in. Hands-on experts, legal groundwork included, no template engine. Schedule a call.