On her first day, a new marketing coordinator posted a photo to a professional networking site: her badge on its lanyard, her new desk, and a whiteboard of project names behind her. Within a week someone had printed a convincing copy of the badge, and two of her coworkers received texts from "the CEO" asking for gift cards. She hadn't broken any rule she'd been taught, because nobody had taught her that one.
What a program teaches matters as much as how it teaches. On the CompTIA Security+ SY0-801 exam this falls under objective 5.6, which expects you to pick the training content that fits a situation and the behavior that content should produce. This lesson works through the topics an awareness program is expected to cover, from social engineering and business email compromise to remote work, BYOD, removable media, situational awareness and operational security, with the action each one should leave people with.
Every training topic should end in a specific action
Training that explains what phishing is but never says what to do with a suspicious email produces people who can define phishing and still click. Each topic should leave the learner with something concrete to do: verify through a known number, deny and report the prompt, hand the found drive to security.
Topic choice comes from risk, not habit. Incident reports, help desk tickets, simulation results and threat intelligence show which attacks reach the organization and which mistakes people make. Roles set the depth: everyone gets the basics of every topic, and the people most exposed to a threat get targeted, deeper material.
| Topic | Action to teach | Needs it most |
|---|---|---|
| Social engineering and emerging threats | Pause, verify, report | Everyone; finance and executives for deepfakes |
| BEC | Call back on a known number before paying | Accounts payable, payroll, HR |
| Credentials | Unique passwords in a manager; deny unexpected prompts | Everyone, administrators most |
| Remote work and BYOD | Secure the setup; keep work data in work apps | Remote staff, BYOD users |
| Removable media and cables | Use only issued devices; hand found ones in | Everyone |
| Situational awareness | Notice and report what doesn't fit | Everyone, reception |
| Operational security | Don't publish what helps an attacker | Everyone, executives, recruiters |
Social engineering training has to keep up with AI-written lures
Social engineering is the foundation topic, because most of the others are variations on it. The training covers the channels attackers use (email, text, voice, QR codes, chat apps and in person) and the pressure they apply: urgency, authority, fear, curiosity and the wish to be helpful. Section 11 teaches the attacks themselves. The awareness version teaches one response: when a message pushes you to act fast, pause, check the request through a channel you choose, and report it.
The objective also lists emerging security topics. This content goes stale quickly, and right now most of it concerns AI. Generative AI writes fluent, well-targeted phishing in many languages and in the company's own style, so the old advice to look for spelling mistakes no longer protects anyone. Training has to move attention from how a message looks to what it asks for: a credential, a payment, a change to bank details, a file, an exception to the normal process. Voice cloning and real-time video deepfakes mean a familiar voice or face on a call isn't proof of identity either. People should rely on verification procedures rather than trying to spot glitches, because the tools improve faster than people's eyes.
Emerging topics also cover employees' own use of AI. Pasting customer records, source code or credentials into a public chatbot can disclose them, so many organizations add an approved-AI-tools rule to the acceptable use policy and to training. Section 16 covers those risks in detail.