Run security awareness training staff will actually complete

TL;DR — The fastest way to run security awareness training people do not hate is to keep it short, role-based, and tied to one clear action per session. The single biggest fix is to stop scheduling one long annual course and instead send a 10-15 minute kickoff, one realistic phishing drill, and one monthly micro-lesson with a manager-approved deadline. Reading time: ~5 min

Goal

When you finish, you will have a repeatable security awareness program your staff can complete with minimal complaints: a published schedule, a short kickoff session, a phishing simulation (fake but realistic scam email test), a simple completion tracker, and a follow-up message for anyone who misses the deadline.

Prerequisites

• An email tool your company already uses to send internal messages, such as Google Workspace Gmail, Microsoft 365 Outlook, or your HR/comms platform
• A spreadsheet tool, such as Google Sheets, Microsoft Excel, or Airtable
• A meeting tool for the kickoff session, such as Zoom, Google Meet, or Microsoft Teams
• Manager approval for one 15-minute kickoff session and one 5-minute monthly follow-up
• A staff list with: full name, work email, manager name, department, and start date
• One person assigned as owner of the program, with permission to email all staff
• If you use a phishing simulation vendor, access to that vendor dashboard; if you do not, use the internal checklist in this article instead
• A written policy or compliance requirement that says training is required, if your organization has one

Steps

Step 1: Decide the exact training format

Use this format exactly for your first cycle:

Kickoff session length: 15 minutes
Kickoff deadline: within 7 calendar days
Monthly follow-up lesson length: 5 minutes
Phishing simulation frequency: 1 test every 60 days
Reminder cadence: 2 reminders before manager escalation
Pass rule: attended kickoff OR watched recording, completed 1 phishing test, completed 1 monthly lesson

What you should see when this succeeds: you have one short program outline that fits on a single page or email.

Step 2: Create the completion tracker

Create a spreadsheet with these exact columns:

A: Full Name
B: Work Email
C: Manager
D: Department
E: Kickoff Assigned Date
F: Kickoff Completed Date
G: Recording Watched Date
H: Phishing Test 1 Sent Date
I: Phishing Test 1 Result
J: Monthly Lesson 1 Sent Date
K: Monthly Lesson 1 Completed Date
L: Status
M: Reminder 1 Sent Date
N: Reminder 2 Sent Date
O: Manager Escalation Sent Date

In column L, enter this exact formula in row 2 and fill down:

=IF(OR(F2<>"",G2<>""),IF(AND(I2<>"",K2<>""),"Complete","In Progress"),"Not Started")

What you should see when this succeeds: each person shows Not Started, In Progress, or Complete automatically.

Step 3: Send the kickoff invite with plain language

In your email or calendar tool, send this exact message to all staff:

Subject: Required 15-minute security training for all staff

Hi team,

Please complete this short security awareness training by [DATE].

What to expect:
- One 15-minute kickoff session
- One realistic phishing test in the next 60 days
- One 5-minute follow-up lesson next month

Why we are doing this:
- To reduce account takeovers, payment fraud, and accidental data sharing
- To meet our compliance obligations

What you need to do now:
1. Join the kickoff session on [DATE/TIME] using [MEETING LINK]
2. If you cannot attend, watch the recording by [DATE]
3. Report suspicious emails to [SECURITY EMAIL OR HELPDESK]

This is not a trick contest and not a public leaderboard. The goal is to help everyone spot real attacks.

Thanks,
[NAME]

What you should see when this succeeds: staff receive one clear message with the time, deadline, and reason.

Step 4: Run the kickoff session

Use this exact 15-minute agenda in your slides or speaker notes:

0:00-2:00 Why this matters: payment fraud, password reuse, fake invoices, data leaks
2:00-5:00 How to check an email: sender address, urgency, unexpected attachment, payment change request
5:00-8:00 How to check a link before clicking: hover to preview, verify domain, use known bookmarks
8:00-10:00 What to do if you clicked: stop, report it, change password, contact IT/helpdesk
10:00-12:00 MFA reminder: approve only sign-ins you started
12:00-15:00 One real example from your business and Q&A

If you record the session, save the file with this exact naming pattern:

Security Awareness Kickoff - YYYY-MM-DD

What you should see when this succeeds: attendees join, and anyone absent has a recording to watch.

Step 5: Launch one phishing simulation people can learn from

If you have a phishing simulation provider, use its dashboard and choose one template with these exact characteristics:

Theme: password reset OR shared document notification
Difficulty: easy
Landing page after click: educational page explaining the red flags
Failure action: immediate coaching message, no public shaming
Audience: all staff except IT/security admins if your policy excludes them
Send window: Tuesday-Thursday, 9:00-11:00 local time

If your provider dashboard varies, use your provider's phishing campaign area (for example, a menu named Security Training → Phishing Campaigns or Campaigns → Create).

If you do not have a phishing vendor, skip the send and record this in your tracker:

I: Phishing Test 1 Result = Vendor not in use; manual awareness only

What you should see when this succeeds: the campaign is scheduled or sent, and every user has a sent date in column H.

Step 6: Send the 5-minute monthly lesson

Send this exact email 30 days after the kickoff:

Subject: 5-minute security refresher: spotting fake payment requests

Hi team,

This month’s refresher takes 5 minutes.

Read these three checks before approving a payment or bank detail change:
1. Verify the sender address, not just the display name
2. Confirm changes using a known phone number or existing contact
3. Treat urgency and secrecy as warning signs

Reply to this email with: Completed
Deadline: [DATE]

If you saw a suspicious message recently, forward it to [SECURITY EMAIL OR HELPDESK].

Thanks,
[NAME]

When replies arrive, enter the completion date in column K.

What you should see when this succeeds: staff can complete the lesson in one email without logging into another system.

Step 7: Send reminders and manager escalation

Send Reminder 1 three days before the deadline:

Subject: Reminder: security training due [DATE]

Hi,

Our records show your security awareness training is still incomplete.
Please complete it by [DATE].

Need help? Reply to this email.

Send Reminder 2 on the deadline day:

Subject: Due today: security training

Hi,

Please complete your required security awareness training today.
If you cannot access the recording or lesson, reply to this email now.

Send manager escalation two days after the deadline:

Subject: Incomplete security training for your team member

Hi [MANAGER NAME],

[EMPLOYEE NAME] has not completed the required security awareness training.
Please ask them to complete it by [NEW DATE].

What you should see when this succeeds: overdue completions start moving after Reminder 2 and manager escalation.

Verify it works

Check these five things end to end:

1. In your calendar or meeting tool, the kickoff session shows attendees or a recording link.
2. In your spreadsheet, column L shows a status for every person.
3. At least one phishing test result exists in column I, or the manual note Vendor not in use; manual awareness only is present.
4. Monthly lesson replies are arriving, and column K has dates.
5. Completion rate is visible with this exact spreadsheet formula in an empty cell:

=COUNTIF(L:L,"Complete")/(COUNTA(A:A)-1)

Expected result: the cell shows a percentage. For a first cycle, a practical target is 85%+ by the deadline and 100% after manager follow-up.

Use this simple flow to confirm the program sequence:

[Owner] ---- 1. kickoff invite ----> [Staff]
[Owner] ---- 2. run session ----> [Meeting Tool]
[Staff] ---- 3. attend/watch ----> [Meeting Tool]
[Owner] ---- 4. phishing test ----> [Staff]
[Owner] ---- 5. monthly lesson ----> [Staff]
[Staff] ---- 6. reply/complete ----> [Tracker]
[Owner] ---- 7. reminders ----> [Staff]
[Owner] ---- 8. escalation ----> [Managers]

Common pitfalls

Sending one long annual course

Mistake: assigning a 45-60 minute training once a year.

Symptom: low completion, late completions, and negative feedback like "I do not have time for this."

Fix: replace it with the exact schedule from Step 1: 15-minute kickoff, one phishing test, one 5-minute monthly lesson.

Using public shaming after phishing tests

Mistake: posting names of people who clicked the fake email.

Symptom: staff stop reporting suspicious emails because they do not trust the program.

Fix: use an educational landing page and private follow-up only.

Picking a phishing template that is too hard first

Mistake: starting with a highly convincing executive fraud or payroll scam.

Symptom: even careful staff fail, and the exercise feels unfair.

Fix: set the first campaign to Difficulty: easy and use a common theme like password reset.

No manager-approved deadline

Mistake: sending training without a date agreed by managers.

Symptom: staff treat it as optional and reminders are ignored.

Fix: put one exact due date in the kickoff email and use the escalation email in Step 7.

Tracking completion in multiple places

Mistake: attendance in one tool, phishing results in another, and lesson replies in email only.

Symptom: you cannot prove completion during an audit or internal review.

Fix: enter every completion date and result into the single tracker from Step 2.

Teaching policy instead of real attacks

Mistake: filling the session with rules and definitions only.

Symptom: staff remember none of it when a fake invoice or password reset arrives.

Fix: use one real business example in the 15-minute agenda and tell people exactly how to report suspicious messages.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.