What is security awareness training?
Security awareness training (SAT) is structured education that teaches employees to recognize and respond to cyber threats - phishing, social engineering, unsafe data handling and credential misuse. Programs typically combine courses, simulated phishing exercises and periodic refreshers, and are required by many compliance frameworks. Its effectiveness depends on whether it changes behavior, not just knowledge - which is where traditional one-size-fits-all programs struggle.
Also known as: security awareness training · SAT · cybersecurity awareness · phishing training · security education
What a program covers
Core curriculum spans phishing and business email compromise recognition, password and MFA hygiene, safe data handling, physical and remote-work security, and how to report an incident. Delivery ranges from annual video courses tracked in an LMS to continuous programs with simulated attacks. Frameworks like ISO 27001, SOC 2 and most cyber-insurance questionnaires expect documented training, which is why nearly every organization runs something.
The gap between knowing and doing
The uncomfortable finding of two decades of SAT: completion rates and click rates are barely correlated. People fail phishing tests for reasons a video cannot fix - habit, fatigue, urgency, authority pressure. Modern programs close the gap with personalization: simulations tuned to each person’s susceptibility profile and coaching delivered at the moment of the risky action. That behavioral turn is what separates human risk management from classic SAT.
In the Lionet portfolio
Dcoya turns awareness training into measured behavior change - distributed by Lionet.
FAQ
Common questions.
How often should security awareness training run?
Continuously, in small doses. Evidence favors short, frequent, personalized touches - a targeted simulation monthly, coaching on failure - over one long annual course that is forgotten by February.
Is security awareness training required for compliance?
Most frameworks require it or strongly imply it: ISO 27001, SOC 2, PCI DSS, HIPAA and typical cyber-insurance policies all expect documented, recurring employee security training.
Does simulated phishing actually help?
Yes, when personalized and paired with immediate coaching: simulation is the only way to measure real behavior rather than quiz recall. Poorly designed programs - generic templates, punitive framing - measure little and breed resentment, so design matters as much as tooling.
Related explainers: What is human risk management?Why does security awareness training fail?What is business email compromise (BEC)?
Weighing approaches? Personalized behavioral training vs annual awareness training: what actually changes behavior?