The launch usually goes fine. An email from the CISO, a baseline phishing simulation, modules assigned by department, and by month two the click rate is down far enough to put on a slide.
Then month seven. Nobody’s opened the dashboard since April. Threat intelligence shows a new phishing attack hitting your sector, but there’s no training behind it because the module doesn’t exist.
Most security awareness training programs survive their launch. They come apart in maintenance. Cyber threats change faster than an annual training calendar does.
If you’re building or inheriting a program, you need to know where to start, who owns what, how to structure training, what to measure, and how to keep it current.
What is a security awareness training program?
A security awareness training program is an ongoing plan for teaching employees how to recognize cyber threats, reduce risky behavior, and respond appropriately when something goes wrong.
The training library is one part of that program, but having a collection of modules doesn’t give you a program. A complete security awareness training program needs five working parts:
- Content: What employees learn, from phishing and social engineering to password security and handling sensitive data.
- Cadence: When training, reinforcement, and phishing simulations happen.
- Ownership: Who decides what gets trained, who delivers it, and who acts on the results.
- Measurement: How you track behavior change and whether human risk is actually moving.
- Adaptability: How quickly the program can respond to new cyber threats, vulnerabilities, policies, and changes in user behavior.
The last one is where programs tend to struggle. If your threat intelligence changes this month but your training plan can’t change until next quarter, the program is already falling behind.
How to start a security awareness training program
Start with a baseline, not a curriculum. Run a blind phishing simulation and a short risk assessment before you assign training. You need to know where human risk sits before you can decide what the program should address.
1. Establish your baseline
Measure:
- Click rate: How many end users interact with the phishing test.
- Report rate: How many recognize and report suspicious emails.
- Time to report: How quickly a phishing email reaches your security team.
- Risk by role and department: Where risky user behavior and vulnerabilities concentrate.
Don’t rely on the company-wide average. Finance, engineering, executives, and other high-risk groups face different social engineering tactics and may need different training.
2. Get an executive sponsor
Secure sponsorship before launch. The executive sponsor should provide:
- Budget for the program.
- Authority to make participation mandatory.
- A launch message from leadership rather than another request from IT.
3. Use the baseline to design the program
Let your risk data determine the curriculum. If phishing attacks are the immediate problem, prioritize phishing simulations and reporting behavior. If sensitive information is being mishandled, train that behavior instead.
Choose the platform after you know what the program needs to do. Choosing one first means your security awareness training program can end up shaped around the vendor’s content library instead of your actual cyber risk.
If you’re already mid-contract and your current platform can’t cover the risks you’ve identified, switching platforms may not need to wait until renewal.
Why do security awareness training programs fail?
Security awareness training programs stall when nobody has enough ownership, time, or authority to keep them moving. The 2026 SANS Security Awareness and Culture Report found that programs successfully changing workforce behavior had at least three full-time employees (FTEs) dedicated three-quarters of their time to the program. Reaching the culture-change stage required at least 4.3 FTEs.
But resourcing is only part of the problem. Ownership is another issue.
Ownership often sits awkwardly between security and HR or L&D. Security has the threat intelligence and understands the organization’s cyber risk, but may not have the learning design or internal communications capability. HR and L&D know how to build learning paths, communicate with end users, and manage delivery, but they’re further from emerging cybersecurity threats and attack patterns.
Decide who owns what
Split responsibility before the program launches:
- Security: Owns phishing simulations, simulation cadence, scenario selection, threat intelligence, and human risk measurement.
- HR and L&D: Own scheduling, communications, enrollment, learning paths, and the learner experience.
- Executive sponsor: Owns budget and mandate and breaks ties when priorities conflict.
Put those responsibilities into a RACI or one-page program charter. At minimum, name who approves training, who can change the schedule, who responds when new cyber threats emerge, and who reviews the results.
Then test your ownership model with one question: Who decides what gets trained next quarter?
If you can’t name that person, the program is running on inertia.
How should you structure security awareness training?
Build your security awareness training program in three layers: baseline cybersecurity training for everyone, role-based training for higher-risk groups, and reinforcement between scheduled sessions. Each layer has a different job.
1. Set baseline security awareness topics
Every employee needs the fundamentals:
- Phishing and spear phishing
- Social engineering attacks
- Business email compromise and invoice fraud
- Password security and MFA
- Handling sensitive data and sensitive information
- Malware and ransomware
- Incident reporting
Teach each topic as a behavior, not a subject. “Understand social engineering” describes a quiz. “Verify a payment change using a number you already hold” describes something an employee can actually do when an attack lands.
2. Add role-based training
Build learning paths around the cyber risk attached to each role rather than giving every employee more of the same content.
- Developers: Secure coding, access controls, sensitive data, and the vulnerabilities they’re likely to encounter in their work.
- Finance: Business email compromise, phishing scams, payment verification, and the social engineering tactics used to change bank details or redirect payments.
- Executives: Spear phishing, deepfakes, voice cloning, and other targeted social engineering attacks that exploit their authority or public profile.
The human threats landing on trained workforces in 2026 covers how these attacks work in practice.
3. Set a training cadence
Don't treat annual cybersecurity awareness training as the cadence for the whole program. The annual cycle is a compliance checkpoint, not a learning schedule, and the two serve different purposes.
PCI DSS requires security awareness programs to be reviewed at least once every 12 months. Requirement 12.6.3.1 also requires training to cover phishing and social engineering; that requirement became mandatory on March 31, 2025.
Research also supports repeated reinforcement. A Computers & Security scoping review of 42 phishing-training studies found that training effects lasted up to six months, showing how quickly training decays without reinforcement. An annual training cycle leaves too much time for that learning to fade, so build shorter refreshers and repeated practice into the program.
For the program itself, use:
- An annual baseline and compliance review
- Regular phishing simulations
- Short reinforcement between scheduled training
- Additional training when threat intelligence or user behavior shows a new risk
4. Reinforce behavior between training sessions
Scheduled training shouldn't be the only time employees encounter security. The months between sessions are where most of the forgetting happens, and where most real attacks land.
Use phishing tests to identify risky behavior, then reinforce the relevant behavior while the event is still fresh. Training delivered at the moment of failure can turn a failed simulation into immediate coaching rather than waiting months for the next module.
Quizzes, short nudges, and gamification can support that reinforcement, but the program also needs to handle risks that weren’t on the original calendar: a new artificial intelligence policy, a regulatory requirement, a new tool, or a cyberattack targeting your sector.
That’s where a fixed training catalog becomes a constraint. If creating new training means joining a vendor’s content queue, your security awareness training program can’t respond at the speed your threat landscape changes.. Adding a topic mid-program covers how to close that gap.
How do you measure a security awareness training program?
Measure behavior change and human risk over time, not completion rates alone. Completion tells you whether cybersecurity training was delivered. It doesn’t tell you whether your security posture improved or whether end users respond differently when a real attack lands.
Track four behavioral metrics:
- Report rate against click rate: Measure how often employees report phishing emails alongside how often they click. Someone who clicks and immediately reports presents a different risk from someone who clicks and says nothing.
- Time to report: Track how long it takes employees to flag suspicious emails. That gap affects how quickly your security team can respond.
- Repeat-failure concentration: Identify end users who repeatedly fall for phishing tests or other social engineering tactics. Organization-wide averages can hide concentrated human risk.
- Risk trend by department: Track whether cyber risk is rising or falling across teams and roles. This tells you where additional training or phishing simulations are needed.
You can then combine simulation outcomes, training interactions, MFA posture, and other user behavior into a risk score for each employee. That gives you a way to track how human risk changes over time rather than relying on a company-wide click rate. Why completion rates measure the wrong thing covers the distinction in more detail.
Completion and engagement still matter. HR and L&D need to know whether people are enrolling, opening training, and completing it. Treat those numbers as a health check on delivery.
Completion tells you whether people took part in the program. Behavior tells you whether it actually worked.
How to keep your security awareness training program current
A security awareness training program has to change as your organization and its cyber threats change. The structures that worked at launch tend to be the ones that quietly stop fitting first.
The SANS Security Awareness and Culture Maturity Model describes five stages:
- Non-existent
- Compliance-focused
- Promoting awareness and behavior change
- Long-term sustainment and culture change
- Optimization and resilience
Programs move through those stages progressively rather than jumping straight from compliance to optimization.
That progression depends on your ability to adapt. New phishing attacks appear. Threat intelligence changes. Employees adopt new tools. Regulatory requirements shift. Your own phishing simulations expose new vulnerabilities and patterns in user behavior.
Build a review cycle into the program. At least quarterly, ask:
- Have our biggest human risks changed?
- Are new social engineering tactics or cyberattacks targeting our organization or sector?
- What are our phishing tests telling us about user behavior?
- Do any roles or departments need different training?
- Have new tools, policies, or regulatory requirements created training gaps?
- Can we create and deploy the training we need now, or are we waiting on a vendor’s content roadmap?
The plan shouldn’t be fixed. The process for reviewing and changing it should be.
Build a security awareness training program that can change
The calendar was never the problem. The problem in month seven was that changing it took a quarter, while the attack pattern only needed six weeks.
Frame Security is an AI-native Human Risk Security platform built to close that gap. Instead of treating cybersecurity awareness training as a fixed annual curriculum, Frame connects training, phishing simulations, threat intelligence, and human risk signals so the program can respond as risk changes.
With Frame, security teams can:
- Create training when they need it. Security awareness training runs through AI Content Studio, where teams can generate a complete, editable module from a description or uploaded internal policy.
- Personalize content to the organization. Training can reflect your policies, org chart, and tech stack instead of relying on the same generic content for every company.
- Find relevant training topics. Discover provides generated training collections organized by compliance framework, threat type, and region, with the library rebuilt weekly.
- Measure human risk at employee level. Human risk reduction brings together phishing simulation results, training activity, MFA posture, and behavioral signals in a Human Risk Score.
- Act when risk changes. When an employee crosses a risk threshold, Frame can trigger targeted training, a follow-up simulation, or a manager alert.
A security awareness training program shouldn’t still be training for the threat landscape you had at launch. Build the program around what your people are facing now.
Book a demo and build a training live on the call.
Security awareness training program FAQs
Who should receive more frequent security awareness training?
Employees with higher access, authority, or exposure should receive more frequent security awareness training, alongside anyone whose behavior indicates elevated human risk.
Should contractors receive security awareness training?
Contractors should receive security awareness training if they access company systems, sensitive data, or information. Base their training and phishing simulations on their access and cyber risk.
When should you update security awareness training content?
Update security awareness training content after security incidents, new threat intelligence, major technology or policy changes, or new social engineering tactics targeting your organization.
