In short: A security awareness training programme is a year-round plan of training and testing. Build one in eight steps: run a baseline phishing test, set measurable goals, define audiences, choose a platform, plan a 12-month calendar, run regular simulations, report progress to leadership, and review and adjust the content each year.
The eight steps
- Run a baseline. Send one realistic phishing simulation to everyone before any training. It gives you an honest starting point and shows the board why the programme matters.
- Set goals you can measure. Focus on behaviour: raise the report rate, shorten the time to first report, reduce repeat clickers and reach full completion. Avoid targets that reward hiding mistakes. See measuring security awareness training effectiveness.
- Define your audiences. Everyone gets the core curriculum; finance, HR, IT, executives and new starters get extra content. Include contractors and volunteers with system access.
- Choose a platform. Match it to your email platform, licences, languages and who will run it. See choosing security awareness training software and the vendors hub.
- Plan a 12-month calendar. One short module a month, a simulation every month or quarter, and a themed push in October. A sample calendar is below.
- Launch with leadership. A short message from a director explaining why, what to expect and that reporting is always welcome. Leaders should take the training too.
- Run simulations ethically. Vary themes and difficulty, avoid lures that cause real distress, teach on the spot and never shame clickers. See building a positive security culture.
- Report and review. Share a short report each quarter and review the plan each year, refreshing content rather than repeating it.
A sample 12-month calendar
Adjust the order to your risks and your year. Schools may avoid exam season; accountants may move tax-themed content to January.
| Month | Training module | Simulation theme |
|---|---|---|
| 1 | Induction: the core essentials and how to report | Baseline (password expiry or shared document) |
| 2 | Phishing awareness | Parcel delivery notice |
| 3 | Passwords and MFA | Fake MFA or account sign-in alert |
| 4 | Social engineering by phone and text | Invoice from a known supplier |
| 5 | QR code phishing | QR code in an email or attachment |
| 6 | Remote working | HR or payroll update |
| 7 | Business email compromise | Urgent request from a senior manager |
| 8 | Safe use of AI | Collaboration-app or file-share notification |
| 9 | Ransomware | Attachment-based lure |
| 10 | Cyber Security Awareness Month and a quiz | Themed week plus report-button push |
| 11 | GDPR and data handling | Seasonal shopping or delivery offer |
| 12 | AI phishing and deepfakes | Harder, tailored lure for the year-end check |
Role-based modules run alongside: help desk social engineering for IT, BEC refreshers for finance and board training for directors.
New starters and leavers
A programme that only covers the people who were there on launch day quickly falls out of date. Use directory sync from Microsoft Entra ID or Google Workspace so new starters are enrolled automatically, and give them a first-week security induction covering passwords, MFA, phishing, reporting and acceptable use. Leavers should be removed automatically too, so reports stay accurate.
Reporting to leadership
Keep the quarterly report short and visual:
- Completion by team, with any overdue modules
- Click, credential-entry and report rates for each simulation
- Time to first report, the clearest sign of a healthy culture
- Trend since the baseline
- Real phishing reported by staff, and what it prevented
- Actions for next quarter
Directors should see the people side of cyber risk alongside the technical side, as the Cyber Governance Code of Practice expects.
Making it engaging
Programmes that feel like a chore get rushed. Mix in security awareness ideas that staff enjoy: security champions in each team, short lunch-and-learns, team leaderboards for reporting rather than for clicking, and a newsletter that shares real (anonymised) phishing your staff caught.
Let us build it for you
We can build this programme on the platform that fits you and run it month by month. See managed security awareness training.
Contact us to start with a baseline phishing test.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How long should a security awareness training programme last?
It should be continuous. Plan in 12-month cycles, with monthly training and regular simulations, then review and refresh the content each year rather than stopping.
How often should we run phishing simulations?
Monthly or at least quarterly. Regular, varied simulations give a reliable picture without causing fatigue; some platforms adapt frequency and difficulty to each user automatically.
What should a security awareness programme include?
A baseline test, a core curriculum for everyone, role-based content, regular phishing simulations, a report button, automatic enrolment of new starters, and regular reporting to leadership.
Who should own the security awareness programme?
Usually IT or information security, with visible sponsorship from a director. HR often helps with induction and communications. If no one has the time, a managed service can run it for you.