TL;DR—
- Spinning up security awareness training ideas is easy; packaging them to change behavior—not check boxes—is hard.
- To create impactful micro-trainings that change user behavior, you must answer these five simple questions:
- Why this training, now?
- Who are you trying to reach? (Hint: not everyone!)
- What can people do?
- Are you worried about an attack or a behavior?
- What will people see?
Build security answers—not more questions or fear.
Most security teams don’t struggle with finding awareness training topics.
After all, there’s no shortage of scary headlines, threat intel write-ups, or “everyone should know this” moments in our daily news feeds—let alone what you’re seeing on the backend during incidents or need for compliance.
The harder part is turning all that noise into a single briefing or communication that this unique group of people understands, instead of dismissing or panicking over.
Impactful security training relies on these 5 questions.
Here at Fable Security, when our clients request custom briefings, we slow things down and ask these five questions. Not to be difficult—but because these answers shape everything from context and tone, to examples and screenshots.
- Why do you actually need to produce this training or send out this notice right now?
- Who specifically needs to see it?
- What do you want people to do differently after receiving your training?
- Are you worried about this specific attack, or this type of attack?
- What would someone see or experience on the front end of this attack?
Miss answering even one of these questions, and your well-intentioned user awareness training will just turn into background radiation instead of changing employee behavior.
Over the next few weeks, we’ll be releasing deep dives into each of these questions—so sign up to get each as they’re released.
For now, though, take a deep breath and ask yourself: Why this training, now, to these people?
(And, for ten more questions to ask yourself when determining the value of your human risk management program, turn to page 25 of “Modern Human Risk Management for Dummies”.)
