In February 2026, criminals impersonated a trusted vendor of Dickinson Public Schools in North Dakota and redirected two payments from the district’s building fund. The district reported $4.92 million gone.
The attack worked because a fraudulent payment request appeared to come from an organization the district already trusted. That is a harder decision than spotting an obviously suspicious sender: the employee has to question a request that appears familiar and legitimate.
That gap between the attack employees expect and the one that actually arrives is what cybersecurity training needs to close. This guide covers what to teach, who needs which training, how often to run it, which exercises change behavior, and how to measure whether they’re working.
What is cybersecurity training?
Cybersecurity training is a structured program that teaches employees to recognize and respond to cyber threats they may encounter at work. It focuses on the decisions people make, such as approving a payment, granting access, scanning a QR code, or answering a call, and the behaviors that reduce cyber risk.
The term also covers professional certification tracks that prepare security practitioners for roles like SOC analyst or cloud security engineer. Those programs build a specialist skill set for people whose full-time job is security.
However, this article is about workforce cybersecurity awareness: helping employees make safer decisions as part of their everyday roles.
Contractors hold credentials, recruiters take calls from strangers all day, finance teams approve payments, and help desk agents reset passwords and enroll MFA devices. Effective security awareness training has to reach everyone whose decisions could give an attacker access, information, or money.
Most employees can already define phishing and will tell you not to reuse passwords, so awareness itself is rarely what’s missing. The gap opens in the moment itself, when a payment change arrives from a vendor the company has used for years and someone has to stop a process that is already moving. Training works when that pause happens by default, because the employee has practiced that exact situation, has a verification step to fall back on, and knows that reporting a mistake will not cost them anything.
Cybersecurity training has to keep up with changing attacks
Verizon’s 2026 Data Breach Investigations Report found that the non-intentional human element played a part in 62% of breaches. In other words, someone was tricked or made a mistake somewhere along the way. That figure hasn’t changed much. What has changed is what those attacks look like.
Employees are no longer just dealing with suspicious emails and obvious phishing links. The same social engineering now shows up in very different forms:
- Voice calls: Someone impersonating an executive, colleague, or IT support.
- Collaboration tools: An external account contacting an employee through Microsoft Teams or another trusted workplace platform.
- QR codes: A code that takes the employee away from the device or environment where existing security controls can help.
- Deepfake video: A familiar face generated or manipulated using artificial intelligence appears on a video call, but isn’t actually the person it claims to be.
- Familiar business requests: A payment change, password reset, or access request that looks like part of a normal process.
The problem isn’t that employees have forgotten what phishing is. Knowing what yesterday’s phishing email looked like doesn’t necessarily prepare someone for the next version of the attack.
Cybersecurity training needs to keep up with that evolution. Yet static content libraries can make that difficult. Training is released on the vendor’s schedule, while new threats and tactics can emerge much faster.
And newer channels are now even harder to spot. Verizon found that phishing simulations using mobile channels such as voice and text had a 40% higher median success rate than email simulations. As the human threats landing on trained workforces in 2026 continue to evolve, employees need to practice dealing with the versions of these threats they’re likely to face today, rather than waiting for the next content refresh.
What should cybersecurity training cover for different roles, and how often?
Cybersecurity training should reflect the decisions someone makes in their role, and happen often enough for those behaviors to stick.
What cybersecurity training should cover
Start with three layers:
- Universal topics: Some threats and security behaviors apply across the workforce, regardless of role. This includes phishing, password and MFA hygiene, data handling, invoice fraud, and incident reporting.
- Channel-specific topics: Employees also need to know how threats change depending on where they encounter them. That means preparing for voice cloning over the phone, deepfake video on calls, QR phishing, and attacks through collaboration tools.
- Role-specific topics: Other risks and vulnerabilities depend on someone’s role and the decisions they make as part of their job. Training might cover secure coding for engineers, payment verification for finance, callback verification for help desk teams, and synthetic-candidate detection for recruiters.
Take recruiters as an example of why role-specific training matters. Unit 42 created a convincing real-time synthetic identity in around 70 minutes using free tools and a five-year-old computer. A recruiter may be the first person in an organization to encounter that threat, yet traditional cybersecurity awareness training rarely prepares them to question whether the person on a video call is real.
For recruiters, training should cover the signs of a synthetic candidate and, more importantly, what to do when something feels wrong. That could mean asking an unscripted question, checking identity through another channel, or following a defined verification process before the candidate moves any further through hiring.
How often employees should be trained
Annual training is a common compliance baseline. Most frameworks set the bar at onboarding plus a yearly refresh, which is why the majority of programs default to that rhythm.
- PCI DSS Requirement 12.6.3 requires security awareness training when employees are hired and at least annually.
- HIPAA requires a security awareness and training program with periodic security updates.
But compliance requirements are there to set a minimum standard, not to tell you the best cadence for learning. Training once a year may give you the evidence you need to show the requirement has been met, but that doesn’t mean employees will remember what they learned for the next 12 months.
In fact, people forget what they learn quite quickly. A 2023 review in Computers & Security found that the effects of phishing training lasted no more than six months, although refresher training could extend them. Understanding how fast simulation performance decays can help you plan training around how long those lessons actually stick.
A practical cadence looks more like:
- Annual baseline training
- Short refreshers throughout the year
- Extra training when the risk changes, such as a new phishing campaign, collaboration tool, remote access policy, or higher-risk role
The best cybersecurity training exercises give employees hands-on practice
There’s a limit to what employees can learn from being told how an attack works. Simulations let them practice what to do, whether that’s spotting a phishing email, questioning who’s on the other end of a call, or deciding whether the familiar face on screen can be trusted.
Different exercises test different things:
For cybersecurity training to work, simulations need to feel realistic. Use real vendors, communication patterns, and details from your org chart. That way, employees practice against attacks they could actually face. A generic phishing template mostly tests whether they can recognize a generic phishing template.
How you run simulations matters, too. Avoid turning them into a gotcha with public failure lists or punishment for mistakes. That can make people less likely to report when something goes wrong for fear of being shamed. You want employees to speak up quickly, not worry about getting in trouble.
How to measure whether cybersecurity training is working
Completion rates tell you who finished the training. They don’t tell you whether it changed anyone’s behavior or who is still most likely to fall for an attack.
To understand that, you need to look at what employees actually do:
- Report rate vs. click rate: Clicking tells you someone fell for the simulation. Reporting tells you whether they recognized their mistake and raised the alarm.
- Time to report: The faster someone reports an attack, the sooner your security team can respond.
- Repeat failures: Look for employees who repeatedly struggle with the same threats. An organization-wide average can easily hide where risk is concentrated.
- Risk by department: Tracking results by team helps you see where risk is increasing and where additional training may be needed.
Good risk management needs a clearer picture of where that exposure sits. You can then combine those behaviors with other signals to understand risk at an individual level. Frame Security’s Human Risk Score uses simulation results, training interactions, MFA posture, and behavioral signals to build a score for each employee, which can also be viewed across teams.
This gives you a much better picture than completion alone. As we explain in why completion rates measure the wrong thing, finishing a module tells you that someone attended the training. It doesn’t tell you how they’ll respond when an actual attack arrives.
That distinction matters when you’re asked to show whether your cybersecurity training is working. A completion rate proves the training happened. Behavioral data helps you show whether it made a difference.
What to look for in a cybersecurity training platform: four questions to ask
If you’re comparing cybersecurity training platforms, look beyond the size of the content library. The bigger question is whether the platform can keep training relevant as your risks change.
1. How quickly can you create training for a new threat?
Look at how new content is created and how long it takes to reach employees. The gap between a threat emerging and training landing in an inbox is the number that matters here.
A static library relies on the vendor’s release schedule, while tools that let you generate and edit your own content can respond much faster.
If you’re already tied into another platform, it’s also worth checking what switching from your current provider involves rather than waiting for the contract to expire.
2. Can you run simulations outside email?
Email phishing still matters, but employees are also targeted through phone calls, collaboration tools, and video.
Check which channels the platform supports and whether simulations can reflect your own vendors, teams, and communication patterns.
3. Does it measure behavior or just completion?
Look at what sits behind the reporting. A dashboard full of completion percentages answers a different question than one built on how employees behaved.
Useful metrics should show how employees respond to simulations, whether they report threats, where risk is concentrated, and how that changes over time.
4. Can it handle the compliance work, too?
Check which frameworks the training maps to and what evidence you can generate for an audit. Compliance shouldn’t be the only reason you train people, but the platform should make proving it straightforward.
Build cybersecurity training around the threats employees face now
The Dickinson attack is a good example of why all of this is so important. Authorities did eventually trace and seize most of the money: the FBI and U.S. Attorney’s Office recovered $4,856,578.51 connected to the fraud.
But that kind of recovery is unusual, and cyber attacks can get expensive very quickly.
Sophos’s 2026 State of Ransomware report found that 48% of organizations whose data was encrypted by ransomware paid the ransom, while the average cost of recovery reached $1.7 million. That doesn’t include the ransom itself, with a median payment of $769,000.
Effective cybersecurity training gives employees practice with the threats and decisions they’re likely to face before they happen in real life.
Frame brings the key pieces together:
- Train for the threats you’re seeing now. Security awareness training can be created in AI Content Studio using your own policies, technology, and organizational context.
- Practice across different channels. Phishing and deepfake simulations cover email, voice, and video, with coaching when someone falls for an attack.
- Tailor training to individual risk. Human risk reduction combines training and simulation results with other behavioral and security signals in a Human Risk Score for each employee.
- Act when risk changes. Frame can trigger targeted training, follow-up simulations, or manager alerts when an employee’s risk crosses a threshold.
Most cybersecurity training platforms can tell you who completed a module. The harder question is whether your employees are ready for the attack that arrives next.
Frame generates training and simulations around the threats your organization is actually facing, then measures how employees respond.
Book a demo and build a training live on the call.
Cybersecurity training FAQs
How often should cybersecurity training happen?
Run baseline training at least annually, with shorter refreshers and additional training when threats, tools, or employee responsibilities change.
What should cybersecurity training include?
Cover phishing, passwords and MFA, data handling, incident response and reporting, newer attack channels, and role-specific risks.
How do you know if cybersecurity training works?
Look beyond completion rates. Track reporting, simulation performance, repeat failures, time to report, and how risk changes across employees and teams.
