Security+ SY0-801 Security Awareness Training: Types, Delivery, Metrics and Topics

Security awareness training is the program that teaches every member of staff to recognise and report threats aimed at people, and it is the main control against social engineering. Technical controls filter much of what reaches users, but a convincing request that arrives by phone, video call or a real supplier's mailbox still depends on a person deciding what to do. Objective 5.6 asks you to apply four sets of decisions to a scenario:

Because the objective starts "Given a scenario", most items describe a situation and ask which type, mechanism, measure or behaviour fits. The scenario almost always contains one detail that decides it: who is being trained, what triggered the training, whether it must be tracked, or what the person should do next.

Two neighbouring objectives own related material. Compliance-specific training (data handling, anti-money laundering, anti-bribery) and policy acknowledgements and attestations belong to objective 5.4. The technical controls that back awareness up, such as email authentication, mobile device management and data loss prevention, belong to domain 4. This lesson refers to them only as context.

The four training types differ by what triggers the training and who receives it, not by its content. The same phishing module can be onboarding, ongoing, targeted or corrective depending on why it was assigned.

Onboarding versus ongoing

Onboarding sets the baseline once, when someone joins. Its weakness is that any one-off training fades: knowledge and habits learned in a single course weaken over the following months unless they are reinforced. A decline that shows up across the whole workforce over time is therefore a frequency problem, and the answer is ongoing training: short, recurring refreshers and simulations spread through the year, so the reminders never stop.

Targeted versus corrective

This is the distinction most often tested. Both reach a subset of people, but they are chosen differently:

• Targeted training is proactive and chosen by role or exposure. If attackers begin phoning the help desk pretending to be employees who are locked out, the analysts who can reset passwords need extra training on verifying callers now, whether or not any of them has been fooled.
• Corrective training is reactive and chosen by individual behaviour. If an audit finds that two warehouse supervisors lent their badges to contractors, the supervisors themselves receive corrective training. Its scope follows the evidence: the individuals whose behaviour triggered it, rather than their whole team or site.

A quick test: if you could name the audience before anything went wrong, it is targeted; if the audience is defined by what they did, it is corrective.

The delivery mechanism is how the training reaches people, and the right choice depends on scale, whether completion must be tracked, and how tailored the content needs to be.

Four properties separate the mechanisms. Tracking: only an LMS records who completed what. Push or pull: an LMS and live sessions push training to people, while a portal waits for people to pull it. Tailoring: one-to-one adapts to a single person and allows a two-way conversation. Simultaneity: one-to-many delivers the same message to a large audience at the same moment. Work out which of these the situation actually needs, and the mechanism follows.

Type and mechanism are independent. Corrective training is often delivered one-to-one, but it can also be an automatically assigned LMS module; ongoing training can run through an LMS and be reinforced by one-to-many briefings.

An awareness program is effective when it changes what people do, so the most useful metrics measure behaviour, not participation. CompTIA's list says only "metrics"; the skill is choosing a metric that answers the question being asked.

Why the report rate matters more than the click rate

A falling click rate is good news, but it only shows that people avoid the bait. It does not show that anyone tells the security team. Clicks measure avoidance; reports measure detection. A workforce that avoids the bait but stays silent gives the security team no early warning, so the few messages that do succeed stay in mailboxes until a tool or an analyst happens to find them. Reporting turns each employee into a sensor: one early report lets the team pull the message from every mailbox and block the sender before others fall for it. Once clicks are low, the report rate and the time to first report become the measures with the most room to improve.

Prefer measures of the decision a person makes (clicking, submitting data, reporting) over measures of exposure, such as how many messages were delivered or viewed, which reflect what the attacker or the simulation did rather than what the person chose.

Managerial reports versus personnel behavior risk scoring

Managerial reports and behavior risk scores both turn awareness data into action, but they answer different questions: a managerial report tells a manager how their team is doing, and a behavior risk score tells the security team which individuals are riskiest.

The defining property of risk scoring is its input: each person's observed behaviour over time. That makes it the tool for allocating anything scarce, such as coaching hours or stricter controls, to the specific individuals the evidence points to, and for checking afterwards whether their scores improve.

Because risk scores are built from monitoring individuals, they should be handled under the organization's privacy and HR policies and used to help people improve, not to shame them; a program that punishes reporting mistakes quickly stops receiving reports.

Business email compromise (BEC) is fraud in which an attacker impersonates, or takes over the mailbox of, an executive, employee or supplier to trick staff into sending money or sensitive data. It is a form of social engineering, the broader category of attacks that manipulate people rather than systems through authority, urgency, familiarity and secrecy.

BEC is distinct from other email threats. It usually carries no malware and no link; it is a plausible business request. Because there is often nothing technical for a filter to catch, BEC defence depends on people noticing what is being asked.

Common BEC patterns

• Executive impersonation: an urgent, confidential request "from the CEO or CFO" to pay an invoice or wire funds today.
• Supplier or vendor email compromise: the attacker controls a real supplier's mailbox and announces new bank details for upcoming invoices. Email authentication (SPF, DKIM and DMARC) confirms that a message came from infrastructure authorised to send for a domain; it says nothing about who is controlling a legitimate account, so mail sent from a compromised real mailbox is authenticated mail.
• Payroll diversion and gift-card requests: a staff member's "new account details" for salary, or a manager asking for gift cards.

The defence: out-of-band verification on known contact details

The behaviour training must build is to verify any change to payment details, or any unusual payment request, through a separate channel using contact details you already hold, such as the number in the supplier master file or the company directory. This follows FBI Internet Crime Complaint Center (IC3) guidance on BEC. Any contact route supplied by the request itself may belong to the attacker, so it cannot serve as verification; the check must use a channel the requester did not choose. Urgency and requests for secrecy are warning signs, not reasons to skip the check.

Emerging security topics are the new attack techniques an awareness program must add as they appear, and today the most important are AI-generated phishing and deepfake voice or video impersonation. Their common effect is that the old cues people were taught to look for no longer work.

• AI-written, personalised phishing: generative AI produces fluent, natural messages in any language and personalises them with whatever is publicly known about the target. Guidance built around poor grammar, generic greetings or awkward translation no longer separates phishing from legitimate mail.
• Deepfake voice and video: an attacker can clone an executive's voice from public recordings or join a video call as a convincing likeness. A familiar face or voice is no longer proof of identity.

CISA guidance on synthetic media makes the general point: defences that rely on detecting the fake, or on information and channels the attacker may also know or control, are unreliable. Verification has to come from outside the conversation the attacker started.

What works is the same principle as BEC: judge the request, not the presentation. Training should teach people to notice what is being asked (money, credentials, data, an exception to process), how unusual it is, and how much pressure is applied, and then to verify through an independent channel, such as calling back on a number from the company directory, before acting. Keeping the topic current means revising the cues and the verification procedures the program teaches, and refreshing simulations so they reflect the techniques attackers use now.

Password and credential management training teaches people to keep each credential unique and secret and to treat any unexpected authentication request as a warning sign. Its core messages are:

• Never reuse passwords. When an unrelated website is breached, attackers try the leaked email and password pairs against other services (credential stuffing). Staff who reuse a home password at work hand attackers a working corporate login. A password manager makes unique, long passwords practical.
• Use multifactor authentication (MFA) wherever it is offered, and never share codes or approve prompts on someone else's behalf.
• Report suspected exposure of a credential straight away so it can be reset.

MFA fatigue (push bombing)

In an MFA fatigue attack, the attacker repeatedly triggers push notifications to a user's phone, often late at night, hoping the user approves one to make them stop. In password-plus-push setups a prompt is sent only after the correct password has been entered, so an unexpected prompt means someone already has the password (passwordless sign-in can send prompts on a username alone, but the response is the same). Treat a prompt you did not trigger as an incident, not a nuisance: deny it and alert the security team, who can reset the password, end any sessions and investigate. Number matching and showing sign-in details in the prompt make blind approval harder, but they support this habit rather than replace it.

Remote, teleworking and hybrid work training teaches people to protect company data on networks and in places the organization does not control. Two risks dominate:

• Untrusted networks. Café, hotel, airport and conference networks are shared with strangers and should be treated as hostile. Staff should connect through the company VPN, which encrypts traffic between the device and the organization whatever network is underneath.
• Being overlooked. Shoulder surfing and overheard calls leak data in public places. A privacy screen, sitting with the screen away from the room, locking the device when stepping away and taking sensitive calls privately are the matching habits.

Bring your own device (BYOD) training covers personal phones, tablets and laptops that hold company data. The most important behaviour is to report a lost or stolen device to the IT help desk immediately, because the organization can then lock or wipe the company data on it (through mobile device management) and revoke its sessions. Speed is the point: until the report is made, the company data on the device and its signed-in sessions stay reachable by whoever has it, so reporting comes before anything else. BYOD training also covers keeping the device updated and screen-locked, installing apps only from trusted stores, and not letting family members use work apps.

Removable media and cables training teaches people never to connect a found or unknown USB device or cable, and to hand it to the security team instead. Leaving infected USB drives with tempting labels where staff will find them is a social engineering technique called baiting.

The behaviour to train is simple: hand it to security without connecting it. The danger lies in the act of connecting the device to any computer, so no check that involves plugging it in is safe, and security can examine it in an isolated environment.

Why a mass-storage block is not enough

A USB device tells the computer what kind of device it is. Malicious cables and drives can identify themselves as a human interface device (HID), usually a keyboard, and then type commands at machine speed. Endpoint policies that block USB mass storage do not stop this, because a keyboard is a different device class that every computer trusts. Such cables can look exactly like ordinary charging cables, so training must cover cables, chargers and adapters of unknown origin, not just flash drives. Technical controls that restrict new HID devices help, but the first line is people who do not connect hardware they did not get from IT.

Situational awareness is noticing who and what is around you and recognising when something is out of place; operational security (OPSEC) is avoiding leaks of internal information that an attacker could piece together. One is about the physical moment, the other about what you disclose.

Situational awareness

The classic scenario is tailgating, someone following an authorised person through a secured door without badging in; it is often called piggybacking when the authorised person knowingly lets them in, though many sources use the two terms interchangeably. Attackers rely on politeness making refusal feel rude. The trained behaviour is to not let anyone through on your badge and to direct them to the visitor sign-in process at reception, where the people responsible check identity and purpose before access is granted. Situational awareness also covers shoulder surfing, unescorted visitors and unattended devices.

Operational security

OPSEC failures are usually innocent: a selfie at a desk with a staff badge and an open dashboard in view, an out-of-office reply naming who approves payments while you are away, a job advert listing exact product versions, or a conference talk that reveals network design. Each detail helps an attacker plan reconnaissance, craft a convincing pretext or time an attack. Training teaches staff to check what is in the background of photos, to keep project details off public profiles and to think about what a stranger could learn from a post.