Headline or habit? How to choose your next awareness training topic

TL;DR—

Part five of six-part blog series on must-ask questions when creating net-new awareness training.

When Fable Security clients request briefings covering specific attacks, we ask, “Are you worried about THIS attack–or all the attacks LIKE this one?”
Using “headline” attacks hooks employee attention and increases urgency.
More general training encourages broader security habits that proactively block more new attacks.
See “Five must-ask questions for security training that changes employee behavior” for more questions Fable Security asks our clients before creating short-yet-impactful briefings!

The advantages of “trending attack” training hooks

The team here at Fable Security prides itself on offering relevant and customizable training, briefings, and simulations that reflect recent real-world attacks and lures that impact organizations and employees just like yours. By quickly sending out briefings that review attacks that made recent headlines, your organization:

Increases the training’s relevancy, since this attack isn’t a hypothetical or something that happened last year, but rather is happening right now to people just like them;
Reassures anyone who saw the news stories and wondered if the organization was at risk;
Connects action to impact, as the organization can point out how the desired employee action would have stopped attackers (instead of stopping at “you have to do it because it’s policy”).

However, without careful planning and phrasing, employees may not apply the lessons beyond this specific attack.

How “security habits” training proactively block against future attacks

If you take a step back from each individual attack headline, then you can see patterns of frequently reused tactics, techniques, and procedures (TTPs) between various attack campaigns and threat groups. For example, let’s say your organization is concerned about:

Business email compromise (BEC),
Voice phishing, and
The January 2026 Scattered Lapsus$ Shiny Hunters “phishing as a service” kit.

One shared social engineering technique used between all three types of attacks is making the request sound more urgent and immediate—not giving the victim time to think better of the action. If an employee can be trained to stop and question any communication that feels “off” to them, then that employee counters all three attacks at once—even if they didn’t receive a briefing on any specific attack. So when an executive sees yet another breach headline and worries about your organization’s exposure, you can point to the specific security briefings you sent out in the last three months that encourage behavior changes which proactively countered that attack’s TTPs. However, this type of training often lacks the impact and relevancy that headline-driven briefings naturally generate. Frankly, it can be hard for employees to remember good security habits in a vacuum, without that one-to-one applicability of “I can stop this attack with this habit.” —Which is why we highly encourage images and scripts that are sourced from real cyberattacks whenever possible! But we’ll discuss that in the next and final post of this series. (And, for more on how training can focus on employee behavior outcomes—thus proactively defending organizations from future attacks—flip to page 11 of “Modern Human Risk Management for Dummies”.)