Security Awareness Training: Build a Programme That Works

A staff member opens an invoice that looks like it came from a supplier they pay every month. One click later, an attacker is reading your email, watching for the next payment to redirect.

Most businesses respond to this risk by sending a slide deck once a year and ticking a box. That approach does not change behaviour, and it does not hold up when an auditor or insurer asks for proof.

This article is about the programme, not the pep talk. You will see how to baseline your current risk, run phishing simulations that mean something, set a sensible training cadence, and measure whether the click rate is actually falling. The goal is a system you can run every year and show results from.

Throughout, the focus stays on what a small or medium business can run in practice, with a team of a few dozen people and no dedicated security staff. Security awareness training does not need a large budget to work. It needs a clear structure and the discipline to keep it going.

What Does a Security Awareness Training Programme Actually Involve?

A security awareness training programme is a repeating cycle of baselining, teaching, testing, and measuring. It is not a single event. The work sits in four parts that run on a schedule: a starting measurement, short regular lessons, simulated attacks, and reporting that tracks the trend.

An employee training programme of this kind works because of repetition and evidence, which a one-off session cannot offer. A single annual seminar leaves staff with information they forget within weeks. A programme keeps the topic live, catches new starters, and produces numbers you can compare year on year.

Why a one-off session does not change behaviour

People retain very little from a single training event, and threats move faster than an annual refresh can keep up with. Attackers change their lures constantly, so the example you showed staff last March is rarely the one that lands in October.

Behaviour change comes from frequency and feedback, not from volume of content. Short, regular touchpoints with a real test attached do far more than one long session ever will.

What are the four parts of a training programme?

First, a baseline measurement shows where your team stands before any training. Second, short modules teach one idea at a time. Third, phishing simulations test whether the lesson stuck. Fourth, reporting tracks the click and report rates so you can prove the trend is moving the right way.

Each part feeds the next. The baseline tells you which topics to teach first. The lessons give staff something to apply. The simulations check whether they apply it. The reporting then points you back to the topics that still need work. Run for a full year, security awareness training keeps improving because each cycle is informed by the last.

How Do You Baseline Your Current Risk?

You baseline your security awareness training by running a phishing simulation before any teaching begins, then recording who clicked, who entered details, and who reported it. This first number is your starting line, and it is usually higher than business owners expect.

A baseline matters because without it your security awareness training cannot show improvement. If you start training without measuring first, you have no way to prove the programme worked, and no way to spot which teams or roles carry the most risk.

What a realistic first result looks like

It is common for an untrained team to click a convincing test email at a rate well above half. Among a group of 25 staff, that can mean a dozen people handing over credentials to a single test message. Seeing that figure in black and white is often what moves a business from intention to action.

Segmenting risk by role

Not every role faces the same threat. Finance and payroll staff are targeted with fake invoices and payment redirection, while executives attract impersonation attempts that ask for urgent transfers.

Baselining by department lets you direct effort where it counts. A finance team that handles supplier payments needs deeper phishing scams awareness than a warehouse team, and the data tells you so.

Role-based content also keeps training relevant, which keeps people engaged. A payroll officer learns to verify a change-of-bank-account request through a second channel. A receptionist learns to treat an urgent call claiming to be from a director with healthy suspicion. Generic content rarely sticks because it rarely feels like it applies to the person in the chair.

How Often Should Security Awareness Training Run?

Effective security awareness training runs on a continuous cadence: short monthly touchpoints, quarterly focused sessions, and ongoing phishing simulations throughout the year. Annual-only training is the most common mistake and the least effective model.

The reason security awareness training needs frequency is simple. Memory fades, staff turn over, and attack methods evolve. A steady drumbeat keeps the topic present without overwhelming people or pulling them off their work for hours at a time.

What does a workable annual rhythm look like?

A practical pattern is a quarterly training session of around twenty minutes, paired with a monthly phishing simulation that takes each person seconds to pass or fail. New starters get a focused induction module in their first week rather than waiting for the next scheduled round.

This rhythm spreads the effort so it never feels like a burden. Four short sessions and twelve quick tests across a year add up to a serious amount of practice, yet no single moment pulls staff away from their work for long. That spread is the point of treating security awareness training as a steady habit rather than an event.

Keeping sessions short and specific

Each session should cover one clear idea, such as spotting a spoofed sender address or handling an unexpected payment request. Short and specific beats long and general every time, because staff can apply a single concrete rule the same day they learn it.

Specificity also makes the lesson memorable. Telling someone to check the actual email address behind a display name gives them a habit they can repeat. Telling them to be careful gives them nothing they can act on. The best modules end with one action a person will use that week.

What Role Do Phishing Simulations Play?

Phishing simulations are safe, fake attacks sent to your own staff to test whether they apply what they have learned. They are the engine of a security awareness training programme because they turn awareness into a measurable behaviour instead of a self-reported feeling.

A simulation reveals the gap between what people say they would do and what they actually do under a realistic lure. The training then works to close that gap.

How should you run phishing simulations?

Simulations should be regular, varied, and free of blame. The aim is to coach, not to catch people out, so anyone who clicks gets an immediate short lesson rather than a telling-off. Naming and shaming destroys the reporting culture you are trying to build.

Rewarding the report, not just punishing the click

The most valuable behaviour is reporting a suspicious message, because one alert can warn the whole organisation. Tracking your report rate alongside your click rate gives a fuller picture, and pairs naturally with wider social engineering defences that rely on staff raising the alarm early.

What Are Staff Actually Being Targeted With Now?

Phishing and credential harvesting is the most commonly reported attack category in New Zealand, and the lures reaching your staff no longer look like the ones most training still teaches. The NCSC recorded 437 phishing and credential harvesting incidents in the first quarter of 2026 alone.

Training that teaches people to look for bad grammar and generic greetings is preparing them for an attack that has largely been retired. A message written by a language model arrives correctly spelled, correctly formatted, and personalised with details taken from LinkedIn and your own website.

Why the old warning signs no longer help

The tells your staff were taught to spot were artefacts of attackers working in a second language at volume. Those constraints are gone. A convincing message now references a real project, a real colleague and a real supplier, because all three are public.

What still works is procedural rather than visual. Verify an unexpected payment change through a channel you already had, never the one the message arrived on. That rule holds whether the message is crude or flawless, which is why it outlasts every list of warning signs.

Voice, video and text are now in scope

Attackers use cloned audio to ring staff directly and ask for an urgent transfer, and the same approach is appearing on video calls. Text-message phishing, known as smishing, and phone-based attempts, known as vishing, sit outside the email filtering most businesses rely on.

Any programme worth running covers all three channels. Staff trained only on email treat a text or a call as a different kind of thing entirely, which is what the attacker is counting on. IBM’s Cost of a Data Breach research recorded a 56 per cent rise in AI-driven attacks, so the direction of travel is not in question.

How Do You Measure Whether It Is Working?

You measure success with two core figures: the phishing click rate, which should fall over time, and the report rate, which should rise. Tracked together over months, these numbers show whether behaviour is genuinely changing.

Measurement is what separates real security awareness training from a compliance gesture. It also gives leadership a clear return on a modest spend, and gives insurers and auditors the evidence they increasingly ask for.

The numbers that matter

A well-run programme often moves a click rate from above half down into single figures across roughly a year. The exact figures matter less than the direction and consistency of the trend. A flat or rising click rate is a signal to change your content or cadence.

Linking training to insurance and compliance

Many cyber insurance policies and frameworks now expect documented, ongoing staff training. Keeping records of completion, simulation results, and trend reports supports your position when insurers ask for evidence and sits alongside a broader cybersecurity risk assessment as part of your overall security posture.

What Does a First Year of Training Look Like in Practice?

A first year of security awareness training usually moves through three phases: a sobering baseline, a few months of rapid improvement, and a longer stretch of holding the gains. Seeing the shape of a typical year helps set realistic expectations.

Consider a 25-person professional services firm running its first programme. The story below is a composite, but the pattern is one we see often across South Island businesses.

Month one: the wake-up call

The firm sends a baseline phishing simulation before any lessons. More than half the team clicks, and several enter their login details on a fake page. The owner, who assumed staff were already careful, now has a number that makes the case for action on its own.

Months two to six: rapid gains

Short monthly lessons begin, each tied to a fresh simulation. The click rate drops sharply in the first quarter as staff learn the most common tells. Reporting rises as people grow confident that flagging a suspicious email is welcomed, not mocked. The first quarter usually delivers the biggest drop in risk for the least effort.

Months seven to twelve: holding the line

Improvement slows because the easy wins are done, and the work shifts to maintaining the habit and catching new starters. The click rate settles in single figures, and the occasional spike after a clever new lure becomes a teaching moment rather than a crisis. By the end of the year the firm has a documented security awareness training trend it can show to its insurer and its board, which is the kind of evidence boards are expected to ask for.

None of this required a large budget or a full-time security hire. It took a clear schedule, a simulation tool, and someone to own the reporting. For a business that size, that is a modest cost set against the price of a single successful invoice fraud.

What Should a New Starter Get in Their First Week?

A new starter should get a short induction module before they touch a live inbox, rather than waiting for the next quarterly session. Waiting means somebody spends up to three months with access to your systems and none of the training everyone else has had.

The induction does not need to be long. Twenty minutes covering how your business verifies payment changes, who to tell about a suspicious message, and what your multi-factor prompts look like covers the ground that matters in the first weeks.

Why the first weeks carry the most risk

New staff are the easiest people in the business to deceive, because they do not yet know who normally emails them or what a normal request looks like. An attacker asking a two-week-old employee to buy gift cards for a director is exploiting exactly that gap.

They are also the least likely to push back. Somebody still establishing themselves will hesitate to question an instruction that appears to come from a senior name, and that hesitation is what the lure is built around. Telling new starters plainly that querying an odd request is expected of them removes it.

Fold it into the joining process

The practical fix is to make the security module part of employee IT onboarding instead of a separate task somebody has to remember. It happens alongside the account setup, so it cannot quietly be skipped.

What Does Skipping Security Awareness Training Cost?

The cost stays invisible until it is not, which is why it is easy to defer. A single successful invoice redirection can move a six-figure sum to an account overseas before anyone notices, and once it leaves the country the bank rarely gets it back.

The direct loss is usually not the end of it. A compromised mailbox then gets used against your clients and suppliers, sending convincing requests from your real address, and explaining that to the people you work with is harder than replacing the money.

What the wider numbers say

IBM’s 2026 report puts the global average cost of a breach at USD 4.99 million. That covers organisations far larger than most New Zealand businesses, so treat it as direction rather than a forecast for a firm of thirty people.

The figure that should carry more weight locally is the NCSC’s: 1,129 incidents reported between April and June 2026, of which 92 were serious enough to be triaged for specialist technical support. Set against either number, a training programme is a small recurring cost.

Where Does Training Fit in Your Wider Security?

Security awareness training is one layer among several, and it works best when the technical controls behind it are also in place. Trained staff reduce the number of attacks that succeed, but they should never be your only line of defence.

Pairing the human layer with strong cyber security controls gives you depth. If someone still slips, technical safeguards catch what gets through, and an alert staff member catches the clever lure that the filters miss.

People and technology working together

The strongest setups treat staff and systems as partners rather than substitutes. Filtering and authentication stop most attacks at the door, while trained people handle the ones designed specifically to get past those tools.

For most small businesses the practical route is to fold training into a wider managed IT services arrangement, so the simulations, reporting, and technical controls are run and reviewed together rather than bolted on as an afterthought.

Building a culture that lasts

Over time, the goal is a cyber security culture where careful behaviour feels normal instead of imposed. When staff routinely pause before a payment request and report odd messages without being told, the programme is working as intended. Security awareness training works best when it becomes part of how the business operates day to day.

Build Your Human Firewall With Exodesk

Exodesk helps Christchurch, Dunedin, and South Island businesses run security awareness training that is measured, repeatable, and built around real phishing simulations instead of a yearly slideshow.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What is security awareness training?

Security awareness training is an ongoing programme that teaches staff to recognise, avoid, and report cyber threats such as phishing and social engineering. It combines short regular lessons with simulated attacks that test whether behaviour has changed. The aim is to turn employees into an active layer of defence rather than the most common point of failure.

How is a training programme different from a one-off session?

A one-off session delivers information once and is largely forgotten within weeks, while a security awareness training programme repeats throughout the year and measures results. A programme baselines current risk, runs regular phishing simulations, and tracks click and report rates over time. With repetition and evidence behind it, a programme changes how staff behave over time.

How often should security awareness training take place?

The most effective approach to security awareness training is continuous rather than annual. A practical rhythm is a short quarterly session paired with monthly phishing simulations and a focused induction module for new starters. Frequent, short touchpoints keep the topic present and outperform a single long session each year.

What is a phishing simulation?

A phishing simulation is a safe, fake phishing email sent to your own staff to test whether they apply their training. It records who clicked, who entered details, and who reported the message. Simulations turn awareness into a measurable behaviour and reveal the gap between what people say they would do and what they actually do.

How do you measure if security awareness training is working?

Success in security awareness training is measured with two core figures: the phishing click rate, which should fall over time, and the report rate, which should rise. Tracking both over several months shows whether behaviour is genuinely changing. A flat or rising click rate is a signal to adjust the content or cadence.

What click rate should a business expect before training?

Untrained teams commonly click a convincing test email at a rate above half, which surprises most business owners. This first measurement, taken before any training, becomes the baseline you improve against. Without a baseline you cannot prove the programme has worked.

Should staff be punished for clicking a simulated phishing email?

No. Blame and public shaming destroy the reporting culture a programme depends on. Anyone who clicks should receive an immediate short lesson rather than a reprimand, and reporting a suspicious message should be encouraged and recognised. The aim is to coach behaviour, not to catch people out.

Does security awareness training help with cyber insurance?

Yes. Many cyber insurance policies and security frameworks now expect documented, ongoing security awareness training as a condition. Keeping records of completion, simulation results, and trend reports supports your insurance position and demonstrates due diligence to auditors and clients.

Can training replace technical security controls?

No. Security awareness training is one layer among several and works best alongside technical safeguards such as filtering and multi-factor authentication. Trained staff reduce the number of attacks that succeed, but technical controls must catch what slips through. Each covers a gap the other cannot.

Should training cover text messages and phone calls, not just email?

Yes. Text-message phishing, known as smishing, and phone-based attempts, known as vishing, arrive outside the email filtering most businesses depend on, so nothing stops them before they reach the person. Cloned-voice calls asking for urgent transfers now belong in the same category. Staff trained only on email tend to treat a text or a call as a different kind of thing, which is exactly the gap being used.

When should a new employee get security awareness training?

In their first week, before they have access to a live inbox. Waiting for the next quarterly round can leave a new starter working for up to three months without the training everyone else has had, at the point when they are least able to tell a normal request from a suspicious one. Building the module into IT onboarding is the reliable way to make sure it happens.

How do you start a security awareness training programme?

Begin your security awareness training by running a phishing simulation to baseline your current risk and segment it by role. Then set a regular cadence of short lessons and ongoing simulations, and report click and report rates so you can track the trend. A managed IT or security partner can run the programme and supply the evidence you need.