Phishing Awareness Training: Build a Program That Works

Effective phishing awareness training is a continuous program, not a yearly slideshow. It teaches employees to recognize suspicious messages, gives them an easy way to report them, tests them with realistic simulations, and uses the results to improve the next round. It also sits on top of technical controls such as email filtering and authentication, because no amount of training brings the risk to zero.

This guide walks through how a small or mid-size business can set that up: what to teach, how often, how to run simulations without damaging morale, which numbers to track, and where a managed provider fits.

Securetechie

Strengthen Your Phishing Defenses

Securetechie helps small and mid-size businesses manage IT proactively with enterprise-grade cybersecurity and 24/7 monitoring.

Explore IT security services

TL;DR

Train at onboarding, refresh regularly, and run simulations all year. SANS describes onboarding, quarterly refreshers, regular simulations and role-based training for higher-risk groups.
Measure reporting, not only clicks. A rising reporting rate shows employees are acting as your early-warning system.
Match content to the job. Finance, HR, executives, IT administrators and clinicians face different lures.
Pair training with technical controls: filtering, MFA, SPF, DKIM and DMARC, and hardened endpoints.
Keep simulations supportive. Coaching works better than punishment, and regulated businesses should document everything.

What phishing awareness training should cover
Why a once-a-year course fails
A repeatable program: assess, train, simulate, measure, improve
Role-based training beats a generic module
Running phishing simulations that people accept
Metrics that tell you whether it is working
Pair training with technical controls
Our perspective
Getting help running the program
A 90-day starting plan
FAQ
Sources

What phishing awareness training should cover

A good curriculum is short on theory and long on recognition and response. CISA's guidance for small and medium-sized businesses says employees should learn to spot unexpected requests, urgent language, suspicious links and impersonation of people they know. It also says they should verify through a known contact method rather than replying to the suspicious message.

For a baseline topic list, the Department of Defense's CDSE phishing and social engineering course covers phishing, spear phishing, whaling, smishing and vishing, along with recognition indicators and correct response steps. That course is built for a government audience, so use it as a checklist of topics rather than a template for delivery.

For most businesses, the core modules look like this:

Email phishing. Mismatched sender domains, unexpected attachments, links whose destination differs from the display text. CISA suggests hovering over links without clicking.
Spear phishing and whaling. Messages written for a specific person, often impersonating an executive, a vendor or a client.
Smishing and vishing. Text messages and phone calls that push someone to log in, approve a payment or read out a verification code.
Credential harvesting. Fake Microsoft 365 or Google Workspace sign-in pages, and why MFA prompts nobody requested should be reported, not approved.
Payment and payroll requests. Changed bank details, urgent wire requests and gift card asks.
What to do next. How to report, what happens after a click, and why reporting a mistake quickly is rewarded.

That last module matters most. CISA recommends reporting and deleting suspected phishing and changing passwords immediately if compromise is suspected. Employees need to know exactly which button or mailbox to use, and they need to know nobody will be embarrassed for using it.

Why a once-a-year course fails

The research on awareness programs is consistent on one point: engagement is the hard part. A NIST study of federal awareness programs found that 56% had difficulty making awareness information engaging, even though 85% ran phishing simulations and 79% did additional awareness activities during the year. The same study noted that only 44% recognized employees for good security behavior.

HHS makes the same point for healthcare. Its OCR cybersecurity newsletter warns that training is less effective when staff experience it as a burdensome check-the-box slide deck, and recommends relevant scenarios, an easy reporting path and supportive targeted coaching.

The practical lesson: shorten the content, make it specific to your business, and spread it through the year. A 15-minute module each quarter, a few simulations and a short note about a real scam your industry is seeing will do more than a 90-minute annual session.

Why a once-a-year course fails — overview diagram

A repeatable program: assess, train, simulate, measure, improve

CISA's description of anti-phishing program support lists program management, simulated attacks, campaign support, dashboards, reporting and analysis that feeds changes to future training. That maps to a simple cycle you can run in any company.

Five stages of a phishing training cycle

Step 1: Set a baseline

Before training anyone, send a first simulation or review your recent reports of suspicious email. You want to know your starting click rate, reporting rate and the roles most exposed. If you are a qualifying organization, CISA's catalog describes a Phishing Campaign Assessment as a no-cost, six-week engagement for eligible government and critical-infrastructure organizations. Confirm eligibility and availability with CISA before you plan around it.

Step 2: Define audiences and objectives

NIST's security awareness and training program guide recommends defining target audiences, role-specific objectives, delivery methods, documentation of learning, feedback, material updates and exposure frequency. In a small business, that can fit on one page.

Step 3: Train

Start every new hire with a foundational module in the first week, then schedule short refreshers. Add targeted sessions for people who handle money, sensitive records or system access.

Step 4: Simulate

Run simulations on a regular schedule, vary the lures, and deliver a short explanation the moment someone clicks. Section below covers the details.

Step 5: Measure and adjust

Review results, identify which lure types fooled people and why, and feed that into the next training cycle. Keep the records. They are your evidence of a working program if an auditor, insurer or client asks.

Role-based training beats a generic module

NIST's program framework ties training to job responsibilities and system access. A generic module for everyone is harder to defend than content shaped to the person's role. A practical split for a Southern California professional-services firm, clinic or lender:

Role	Typical lure	Training emphasis
Executives and owners	Whaling, fake vendor or board requests	Verification before approving payments or sharing data
Finance and accounting	Invoice fraud, changed bank details	Call-back verification using a known number
HR and payroll	Fake employee direct deposit changes, resume attachments	Identity checks before changing records
IT administrators	Fake admin consoles, MFA fatigue	Privileged account handling, reporting channels
Clinical and front-desk staff	Patient or insurer impersonation	Protecting ePHI, safe handling of attachments
Legal staff	Fake client or court documents	Confirming senders, protecting privileged files
Database and infrastructure staff	Credential theft targeting system access	Least privilege, escalation of suspicious requests

Payroll is a good example of a role where behavior and process need to work together. Alongside phishing training, a few low-tech payroll fraud controls, such as verifying any change to direct deposit details through a second channel, give HR and finance staff a clear rule to follow when a message looks plausible.

Running phishing simulations that people accept

A phishing test for employees is a teaching tool, not a trap. Poorly run simulations create resentment and discourage reporting, which is the opposite of the goal. These practices help:

Announce the program. Tell staff that simulations will happen, why, and that results are used for coaching.
Vary difficulty. A message that impersonates a known vendor with accurate details is far harder to spot than a generic prize notice.
Give instant feedback. When someone clicks, show a short explanation of the warning signs they missed.
Avoid punitive consequences. HHS recommends using results for supportive targeted coaching.
Keep lures ethical. Avoid themes that exploit fear about layoffs, benefits or health.
Make reporting one click. A report button in the mail client beats instructions to forward messages.
Coordinate with IT. Tell your help desk before a campaign launches so reports are handled quickly and nobody treats the test as a real incident.

Healthcare organizations should design reporting and follow-up before launching anything. HHS notes that HIPAA's Security Rule requires security awareness and training for all workforce members, while periodic security reminders are an addressable provision, and it lists simulated phishing as one way to deliver reminders and trigger targeted training. It also says executives should take part, because they may have broader access to ePHI and may be targeted by whaling.

Metrics that tell you whether it is working

A single pass/fail number hides most of what you need to know. South Carolina's Critical Infrastructure Cybersecurity center reported results from a 2024 campaign of more than 30,000 simulated emails: 32.6% were opened, 6.44% were clicked and 3.63% led to credential entry. The gap between each stage is the point. Opens, clicks and credential submissions each tell you something different.

Track these over time:

Click rate by campaign, role and department.
Credential submission rate, which is a better proxy for real damage than a click.
Reporting rate, because the NIST study found that many programs track it as a positive behavior indicator.
Time to report, which tells your security team how fast they get a warning.
Repeat clickers, who need supportive follow-up rather than discipline.
Completion of assigned training, kept as documentation.

Do not chase zero

NIST researchers Susan Dawkins and Julie Jacobs have said that click rates will not stay at zero. A better goal is a multi-pronged defense, customized training and a better understanding of why users are susceptible. NIST's Phish Scale adds that message difficulty and user context matter, so a drop in click rate only means something if campaigns are scored consistently. If you send an easy lure in March and a hard one in June, the numbers are not comparable.

Pair training with technical controls

Training reduces risk, but it does not replace filtering. CISA's counter-phishing guidance for non-federal organizations states that even a well-trained employee can occasionally be tricked, and recommends combining awareness with technical precautions. These include email filtering based on headers and content, URL inspection, sandboxing, blocking macros and active content by default, current blocklists, approved DNS resolvers, and SPF and DMARC authentication.

For businesses on Microsoft 365 or Google Workspace, that translates into a review of:

Multi-factor authentication for every account, with phishing-resistant methods for administrators.
Mail authentication: SPF, DKIM and DMARC. Our DMARC setup guide for small business covers the steps.
Anti-phishing and safe-link policies in the email platform. See our priority controls for Microsoft 365 email security.
Collaboration tools. Phishing does not stop at email, and our page on Microsoft Teams phishing controls explains the exposure.
Endpoint protection and an incident response plan, so a click that gets through is contained quickly. Our incident response plan guide is a starting point.

For more on how the pieces fit, read our overview of phishing and email security for business and our guide to employee security awareness training.

Our perspective

We work with small and mid-size organizations across Southern California, including healthcare practices, law firms, lenders and professional-services firms. Most of them do not lack willingness to train staff. They lack the time to run a program: building campaigns, updating content, chasing completions, producing reports.

Our view is that awareness training belongs inside proactive IT management, not beside it. If your provider already monitors your environment around the clock, manages your email platform and enforces MFA, then the training program can use the same data: which accounts were targeted, which messages were reported, which roles need extra attention. That is the preventative approach we take, resolving issues before they disrupt operations rather than reacting after a breach.

NIST researcher Julie Haney has noted that programs commonly struggle with resources, engagement, customization for diverse workforces, accessibility and measuring impact. Those are exactly the gaps a managed service can close for a business without a dedicated security team. We would add one caution: choose a program you can sustain. Four short, well-run simulations a year with real follow-up beat a monthly blast that nobody reviews.

— Alex

Getting help running the program

If you would rather not run campaigns, content updates and reporting yourself, our team can fold this into a broader security engagement. Our Cybersecurity Solutions cover managed protection with endpoint detection, incident response and risk assessment. For regulated organizations, our Compliance & Security Audits help document training for HIPAA, SOC 2, CMMC and similar frameworks. Our Managed IT Services bring 24/7 monitoring and help desk support under one flat-rate arrangement without long-term contracts.

A 90-day starting plan

Days 1 to 30. Pick one owner for the program. Turn on a report-phishing button. Write the one-page plan: audiences, objectives, frequency. Send a baseline simulation and collect your starting numbers.

Days 31 to 60. Deliver the foundational module to all staff and role-specific sessions to finance, HR, executives and administrators. Announce that simulations are a coaching tool.

Days 61 to 90. Run a second simulation with a different lure type. Compare opens, clicks, credential entry and reports. Meet with the people who clicked, supportively, and update the next training based on what you learned. Store the records.

Then repeat the cycle quarterly. If you have a recent cybersecurity checklist on hand, check the technical items at the same time.

FAQ

How often should employees take phishing awareness training?

Train new hires in their first week, then refresh on a regular schedule. SANS describes quarterly refreshers with regular simulations as part of a continuous program. Add short alerts when a new scam targets your industry.

What is a good click rate on a phishing simulation?

There is no universal number, and NIST researchers say click rates will not stay at zero. Compare your own results over time using lures of similar difficulty, and watch reporting rate and credential submission as well. A rising reporting rate is a healthy sign.

Do small businesses really need phishing simulations?

Simulations are the most direct way to measure whether training changes behavior, and they give you documentation. CISA's small-business guidance recommends identifying training resources and building a culture of awareness. If you are regulated, HHS lists simulated phishing as one way to meet periodic reminders under HIPAA.

Should employees be disciplined for clicking?

Generally no. HHS recommends supportive targeted coaching, and punishment discourages the quick reporting that limits damage. Reserve formal action for repeated, deliberate disregard of policy, and decide that rule in advance.

Is training enough to stop phishing?

No. CISA advises combining training with email filtering, URL inspection, MFA, mail authentication and endpoint protection. Training reduces how often a threat succeeds, and technical controls catch what people miss.