In short
Security awareness training is an ongoing programme of short lessons, simulated phishing and progress reporting that teaches staff to spot and report cyber threats. Forever Systems is vendor-independent: we compare the platforms we supply, recommend the one that fits your size, sector and existing security tools, then set it up and run it for you.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What security awareness training is
Security awareness training teaches the people in your organisation to recognise and respond to the threats that technology does not always stop: phishing emails, malicious links and QR codes, fake invoices and payment requests, impersonation by phone or Teams, weak or reused passwords and careless data handling.
Modern online security awareness training is not a once-a-year video. It combines three things that run all year:
- Short lessons: five-to-fifteen-minute modules on one topic at a time, assigned automatically
- Phishing simulation: realistic but harmless test emails that show who would click, with instant teaching for anyone who does
- Reporting: completion, click and report rates over time, for managers, the board, auditors and insurers
New to the subject? Start with what is security awareness training, then read how to build a security awareness training programme.
Vendors we supply
Why it matters
Phishing has been the most prevalent type of breach or attack in recent editions of the UK government's Cyber Security Breaches Survey, including the 2025/2026 edition published in April 2026, and generative AI makes convincing, well-written lures easier to produce. Technical controls block most of it, but not all, and the messages that get through are aimed at people.
- Regulation: UK GDPR expects "appropriate technical and organisational measures", and staff training is one of the most visible organisational measures. See GDPR training for staff and whether security awareness training is a legal requirement in the UK
- Insurance: cyber insurance proposal forms routinely ask about staff training and phishing tests; see security awareness training for cyber insurance
- Sector rules: academy trusts, healthcare providers, law firms and FCA-regulated firms all face expectations about staff awareness
- Frameworks: the Cyber Essentials requirements include no staff training control of their own, but training makes the five controls stick; see Cyber Essentials and security awareness training
The benefits of security awareness training page sets out the business case for leaders.
Vendor-independent: the platforms we supply
We supply security awareness training from a range of vendors, so the platform is chosen to fit you. They fall into four broad delivery models:
| Delivery model | Examples we supply | Often suits |
|---|---|---|
| Standalone awareness and human risk platforms | usecure, HacWare, Breach Secure Now | Organisations wanting the deepest automation, policy and dark web features |
| Training built into email security | Attack Simulation Training, Proofpoint Essentials Security Awareness, Hornetsecurity Security Awareness Service, IRONSCALES, Check Point | Organisations that want simulations informed by the threats their email security sees |
| Training within a wider security platform | Sophos, Guardz, Acronis, Webroot | Existing customers who want one console for endpoint, backup and training |
| Consultant-led simulation | Bitdefender Phishing Simulation Service | A tailored, expert-run exercise, such as an executive spear phishing test |
Browse every vendor on the vendors hub, or see the security awareness training platforms compared side by side. If you are still working out what features you need, start with choosing security awareness training software.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Topics, audiences and sectors
Cyber security training for businesses starts with the fundamentals everyone needs in cyber security awareness training. Beyond that, a good programme targets the threats each group actually sees:
- Threats: phishing training for employees, AI phishing and deepfakes, QR code phishing, business email compromise, social engineering, ransomware, passwords and MFA and insider threat
- Audiences: cyber security training for employees, new starters, board members and small businesses
- Sectors: schools and academy trusts, charities, healthcare, law firms, accountants and financial services
- Measurement and culture: human risk management, measuring effectiveness and building a security culture
How we run it for you
As a vendor-independent cyber security awareness training provider, we know software alone does not create a programme. When nobody owns the schedule, completion drops within months. Our managed security awareness training service takes the work off your hands:
- A baseline phishing test so you know where you start
- Platform selection from the vendors we supply, matched to your licences, email platform and budget
- Set-up: directory sync from Microsoft Entra ID or Google Workspace, allow-listing, report button and branding
- A 12-month calendar of short modules and varied simulations, with new starters enrolled automatically
- Reporting to the board, auditors and insurers, with trends rather than one-off numbers
Training also works best when the technology behind it is sound: email security, multi-factor authentication and endpoint protection mean the occasional click does not become a breach. Training is one part of Forever Group's wider cyber security services.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Get started
Tell us how many people you have, which email platform you use and what you already license, and we will recommend a platform and a programme. Pricing depends on users, term and service level, so ask us for a quote.
Contact us to arrange a baseline phishing test or a platform recommendation.
Related security awareness pages
A
B
C
F
G
H
I
L
M
N
P
Q
R
S
T
U
V
W
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Frequently asked questions
How often should staff do security awareness training?
Little and often works best: a short module each month plus a simulated phishing email every month or quarter. One long annual session is quickly forgotten, and the NCSC advises delivering training in small, frequent chunks rather than one long session a year.
Which security awareness training platform do you use?
We are vendor-independent. We supply platforms including usecure, HacWare, Breach Secure Now, Guardz, Sophos, Acronis, Webroot, Proofpoint Essentials, Hornetsecurity, IRONSCALES, Check Point and Microsoft Attack Simulation Training, and we recommend the one that fits your environment. See the vendors hub.
Can you prove the training is working?
Yes. We report completion rates, phishing click and report rates, time to report and repeat clickers, and show how they change over time. See how to measure security awareness training effectiveness.
Do you only work with large organisations?
No. Most platforms are licensed per user, so a programme works for a team of five as well as for thousands of staff. See security awareness training for small business.
Is phishing simulation fair on staff?
Yes, when it is run as a blame-free learning exercise. Staff should know simulations happen, clickers get a short lesson rather than a telling-off, and reporting is celebrated.
What is security awareness training?
Security awareness training is an ongoing programme of short lessons, simulated phishing and progress reporting that teaches staff to spot and report cyber threats such as phishing, impersonation and fake invoices. See what is security awareness training.
What should security awareness training include?
Short monthly modules on the core topics, regular phishing simulations, a one-click report button, automatic enrolment of new starters, role-based content for higher-risk teams and regular reports for leadership. The core topics are set out in cyber security awareness training.
How much does security awareness training cost?
Most platforms are licensed per user, monthly or annually, and the total depends on user numbers, term, edition, add-ons and whether you want it managed, so ask us for a quote. See security awareness training cost.
Still have a question about security awareness training?
Ask us and a member of our team will reply by email.