What should staff be able to do differently?

Should everyone receive the same security training?

Everyone needs a clear baseline, but role-specific decisions require different practice. Finance staff may need to verify changes to payment details using an established independent contact route. Service desk staff need to follow identity checks when handling account recovery. Administrators need to understand privileged access and escalation when controls interfere with urgent work.

Scope discovery with HR, operational managers and staff representatives where appropriate. Include contractors and people without routine access to a corporate computer. Identify the behaviours the engagement is intended to support, such as reporting an unexpected authentication request or sharing information through approved channels. Avoid turning every policy paragraph into a learning objective: select decisions that people genuinely encounter and connect them to the organisation's actual procedures.

What if staff know the rule but cannot follow it?

The engagement should identify and escalate the obstacle, rather than treating it as a knowledge problem. A difficult reporting route, unavailable approved tool or conflicting management instruction can make compliant behaviour impractical. More training does not repair those conditions.

Ask the adviser to review the reporting experience from recognition through acknowledgement and follow-up. Staff should know where to raise a concern even when email is unavailable, and should not need to establish that an incident is genuine before reporting it. Provide accessible formats, readable language and learning arrangements suitable for shift patterns. Connect findings to technical safeguards such as multifactor authentication and appropriate access controls. Awareness should operate alongside those safeguards, not become the reason for withholding them.

Are phishing simulations a reliable measure of awareness?

Phishing simulations can reveal aspects of reporting and workflow, but a click result alone is not a reliable measure of an individual's security competence. Message difficulty, timing, job role and technical filtering all affect what happens. Comparing exercises without accounting for those differences can create a misleading improvement story.

If simulations are included, agree their purpose, authorisation, safeguards and data handling before delivery. Avoid humiliating participants, publishing individual rankings or using sensitive personal themes. Do not collect real passwords. Involve HR and privacy advisers where employee monitoring is involved. Explain how results will lead to support and system improvements. A discussion-based exercise may be more suitable when the immediate question is whether staff understand payment verification or escalation, rather than whether they open a particular message.

What evidence is more useful than course completion?

Evidence of relevant decisions and an effective reporting process is more useful than completion alone. Completion can show that assigned learning was accessed; it cannot demonstrate that the organisation will identify an incident or prevent an unsafe transaction.

Agree an evaluation approach that combines learning checks, staff feedback, reporting quality and examination of process barriers. Interpret changes carefully: more reports may indicate greater confidence rather than more attacks, while fewer reports may indicate silence rather than safety. Avoid invented universal pass rates. Record the starting conditions and explain uncertainty. Use aggregated findings where possible and limit identifiable employee records to a justified purpose. Make sure service desk or security teams can handle the reporting behaviour the programme is encouraging.

What should we receive when the engagement ends?

The handover should include role-based objectives, reusable learning materials, reporting instructions, evaluation findings and owners for maintenance. Clarify rights to edit and reuse the materials, accessibility requirements and any platform subscription dependencies. A campaign that cannot be updated when a procedure changes is not a durable result.

Integrate relevant learning into induction, role changes and follow-up after process changes or incidents. Give managers practical guidance on supporting reporting without blame. Separate awareness findings from competence requirements for specialist roles: a general course does not qualify someone to administer identity infrastructure or conduct forensics. Connect the programme to incident response exercises and the ISMS improvement process, with unresolved workflow problems assigned to people who can fix them.

Further reading: NCSC guidance on phishing attacks and NCSC Top Tips for Staff. Use these resources alongside procedures specific to your organisation.