In February, an accounts payable clerk at a mid-sized manufacturer updated a supplier's bank details because an email asked her to, and $86,000 went to a fraudster. Six weeks earlier she had watched the company's annual security video and scored ten out of ten on its quiz. The training happened; it just never reached the moment that mattered.
A security awareness program is the difference between that video and habits people actually use under pressure. On the CompTIA Security+ SY0-801 exam the topic sits under objective 5.6, a scenario objective that expects you to choose the right kind of training, the right way to deliver it and the right way to judge whether it works. This lesson covers how a program is put together: ownership and goals, the four types of training, the four delivery methods, phishing simulations, and the reporting culture that makes simulations worth running. What to teach and how to measure it are the next two lessons.
An awareness program is a managed control with owners, goals and a schedule
Awareness training is an operational control, and most of what it does is directive: it tells people what to do and relies on them doing it. Like any control it needs an owner, a budget, goals and a way to check that it works. A program that consists of one annual course is a compliance record, not a control.
A workable program has a few parts. An executive sponsor funds it and visibly takes part, because staff notice when executives skip training or are excluded from simulations. The security team usually owns it, working with HR on onboarding and records, with legal and privacy on simulation approval and monitoring rules, and with internal communications. Goals come from real risk: the risk assessment, past incidents and help desk tickets show what people actually get wrong. "Get the first report of a phishing email to the security team within ten minutes of delivery" is a goal; "raise awareness" is not. Audiences are defined by role and exposure, since a warehouse picker, a payroll specialist and a domain administrator face different attacks.
Regulations and frameworks often make a program mandatory. PCI DSS requires security awareness training at hire and at least once every 12 months. The HIPAA Security Rule requires a security awareness and training program for the workforce. NIST SP 800-53 has a full Awareness and Training (AT) control family, including role-based training. ISO/IEC 27001 lists awareness, education and training among its Annex A controls, and NIST SP 800-50 is a standard guide to building a program. These set a floor. Meeting them proves training was delivered, not that behavior changed.
Four training types match four moments in an employee's working life
The exam names four types of training. What separates them is the trigger and the audience.
| Type | Triggered by | Example |
|---|---|---|
| Initial (onboarding) | Joining or gaining access | Week-one basics: AUP, report button, MFA setup |
| Ongoing | The calendar | Annual refresher plus a short module each month |
| Targeted | A role or risk profile chosen in advance | BEC module for accounts payable |
| Corrective | A specific failure | Module assigned after submitting a password to a simulated phish |
Initial training comes first because new employees don't know the procedures yet and attackers know it. People announce new jobs on professional networking sites, and fake messages from "the CEO" or "IT onboarding" follow. Onboarding training should be short and practical: how to recognize and report a phish, the acceptable use policy, how the help desk really contacts you, and how to set up MFA and the password manager. Many organizations require it before the account is fully enabled, and privileged access often waits until it's complete.