Security awareness

People are both the most targeted part of an organization and a strong defense when trained. This objective covers phishing campaigns, recognizing anomalous behavior, user guidance and training, reporting and monitoring, and developing and executing an awareness program.

Phishing and behavior

Phishing campaigns send simulated phishing emails to measure and improve how users respond. They teach users to recognize attempts and to report suspicious messages. Anomalous behavior recognition covers risky (unsafe but allowed), unexpected (unusual for that person), and unintentional (honest mistakes) behaviors.

Training topics and program

• Policy and handbooks.
• Situational awareness: noticing tailgaters and shoulder surfing.
• Insider threat awareness.
• Password management.
• Removable media and cables.
• Social engineering.
• Operational security (not oversharing online).
• Hybrid and remote work environments.

Reporting and monitoring track initial and recurring training completion. Program development sets goals, content, and audience; execution delivers it regularly and measures results.

Key terms

Phishing simulation

A controlled fake phishing email sent to staff to measure and train their responses.

Risky behavior

User actions that are unsafe even if allowed, such as reusing passwords.

Unexpected behavior

Activity that is unusual for a particular user compared to their normal pattern.

Unintentional behavior

Honest mistakes that create security risk, such as emailing the wrong recipient.

Situational awareness

Noticing physical and social surroundings, such as tailgaters or shoulder surfers.

Operational security (OPSEC)

Protecting information that could help attackers, such as not oversharing on social media.

Insider threat awareness

Training staff to recognize and report signs that a colleague may be misusing access.

Reporting suspicious messages

Users forwarding or flagging suspected phishing to the security team quickly.

Hybrid work security

Guidance for working securely from home or public places, such as using VPN and securing home Wi-Fi.

Awareness program development

Planning goals, audiences, content, and metrics for security training.

Recurring training

Security training repeated at intervals so knowledge stays current.