# Security Awareness Training That Actually Changes Behaviour By CYBRT Advisory Team 27 May 2026 4 min read On this page 1. Short and frequent beats long and annual 2. Make it relevant to each role 3. Phishing simulations, done well 4. Make reporting easy and celebrate it 5. Measure behaviour, not attendance 6. Leadership sets the tone 7. Meeting compliance requirements 8. A 90-day starting plan Most organisations can show a training completion rate close to 100 percent. Far fewer can show that people behave differently afterwards. The gap between those two numbers is where attackers live. The traditional approach to awareness is an annual online module, a quiz and a certificate. It satisfies an audit checkbox and is forgotten within weeks. Meanwhile, the attacks that get through are aimed squarely at people: a convincing invoice from a known supplier, a password reset page that looks exactly like the real one, a call from someone claiming to be the chief executive who needs a transfer approved before a board meeting. Changing behaviour takes something different. Here is what works in the programmes we run and assess. ## Short and frequent beats long and annual People remember what they practise. Replace the yearly hour-long module with brief content, five minutes or less, delivered every few weeks. Each piece should cover one idea: how to check a link before clicking, what to do with an unexpected attachment, how to verify a payment change request. Repetition over months builds habits that a single session never will. ## Make it relevant to each role A generic programme treats the receptionist and the finance controller as if they face the same threats. They do not. - **Finance and procurement:** invoice fraud, supplier bank detail changes, and urgent payment requests, including ones made by phone or video call using cloned voices or faces. - **HR:** fake applicants carrying malware in CVs, and requests to change employee bank details. - **IT and administrators:** help desk social engineering, privileged account hygiene, and the risks of approving authentication prompts. - **Executives and their assistants:** targeted phishing, impersonation, and the extra care their access demands. - **Everyone:** passwords and passphrases, multi-factor authentication, safe use of AI tools with company data, and how to report something suspicious. ## Phishing simulations, done well Simulated phishing turns training into practice, but it can backfire if handled carelessly. - **Teach in the moment.** When someone clicks, show them a short, friendly explanation of what they missed, right away. That is the point at which the lesson sticks. - **Vary difficulty and themes** to reflect what attackers send to organisations like yours, including Arabic and English lures. - **Avoid cruel lures.** Fake bonus announcements or medical results damage trust in the security team. Realistic does not have to mean manipulative. - **Never shame people publicly.** Repeat clickers need extra support and a conversation, not a name on a list. ## Make reporting easy and celebrate it The most valuable behaviour is not avoiding every bad email. It is reporting the one that looks wrong, quickly, so the security team can pull similar messages from every inbox before anyone else falls for them. - Give everyone a one-click report button in their email client. - Acknowledge every report, and tell people when a report caught something real. - Make it safe to admit a mistake. Someone who clicked and reports within minutes has helped. Someone who stays silent for fear of blame has not. ## Measure behaviour, not attendance Completion rates tell you who sat through the content. These tell you whether it worked: - **Report rate:** the share of people who report a simulated phish. This should rise over time, and it is a better headline measure than click rate. - **Time to first report:** how quickly the first person flags a campaign. Faster means the team can respond before damage spreads. - **Click rate trend** across comparable simulations, by department. - **Repeat clickers:** how many people fall for multiple simulations, and whether targeted support reduces that. - **Real reports:** how many genuine threats were reported by staff, and how many were caught that way. ## Leadership sets the tone When senior leaders complete the training, talk about it and follow the rules themselves, everyone else notices. When they demand exceptions to multi-factor authentication or forward sensitive documents to personal email, everyone notices that too. Brief the executive team separately, focus on the threats they face personally, and ask them to sponsor the programme visibly. ## Meeting compliance requirements The NCA Essential Cybersecurity Controls include a dedicated requirement for a cybersecurity awareness and training programme, and SAMA's framework includes awareness within its governance domain. A behaviour-focused programme still produces everything an assessor asks for: the approved programme, a content calendar, completion records and evidence of simulations. It simply produces results as well. ## A 90-day starting plan 1. **Weeks 1 to 2:** run a baseline phishing simulation and deploy a report button. Agree the metrics you will track. 2. **Weeks 3 to 6:** launch short monthly content for everyone and the first role-based modules for finance and IT. 3. **Weeks 7 to 10:** brief the executive team, and introduce in-the-moment teaching on simulations. 4. **Weeks 11 to 13:** run a second simulation, compare against the baseline, and share the improvement with the whole organisation. Small, steady and measured beats big and annual every time. If you want to see how your current programme compares, questions four and five of our [free maturity assessment](https://cybrt.sa/maturity/) cover training and phishing simulations. How CYBRT can help ## Awareness & Training Employees and stakeholders who understand cyber risk and best practice, so fewer incidents start with human error. ## Keep reading Governance 30 Sept 2026 4 min read ### What Does a Virtual CISO Do? A Guide for Saudi Organisations What a virtual CISO delivers, who benefits, how it fits NCA and SAMA expectations for an in-house security lead, and what a good first 90 days looks like. Governance 20 Jul 2026 3 min read ### Do You Perform Third Party Risk Management? (The EY Breach) What the EY breach of a third-party IT platform teaches about vendor risk, and how to build third-party risk management that works. Resilience 18 Oct 2026 7 min read ### Ransomware Response Plan for Saudi Organizations: The First 72 Hours A practical ransomware response plan for Saudi organisations: what to do in the first hour, day and 72 hours, including NCA reporting and PDPL notice. ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/security-awareness-training-that-works/ Guide for AI agents: https://cybrt.sa/llms.txt