--- title: Four Tips for Creating Modern & Effective Security Awareness Training description: CyberCoach takes a stand against creepy monitoring security awareness training. image: https://blog.cybercoach.com/hubfs/greatidea.png --- [![CyberCoach Full Logo with Bot Icon](https://blog.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg)](https://www.cybercoach.com?hsLang=en) - PRODUCT ## CyberCoach at a glance An industry-changing platform built on peer-reviewed research: phishing, secure coding, and AI skills training, delivered directly in Teams, Slack, or the browser. ### [The Science Behind CyberCoach Why traditional phishing simulations don't work, according to peer-reviewed research from ETH Zurich.](https://www.cybercoach.com/science-behind-cybercoach?hsLang=en) ### [Is Phishing Simulation Legal Under GDPR? 9 steps GDPR requires before you phish your employees — and a new simulation approach that doesn't need any of them.](https://www.cybercoach.com/legal-basis-phishing-simulation?hsLang=en) ### [Pricing Flexible plans, also monthly. ](https://www.cybercoach.com/pricing?hsLang=en) ### [Blog Latest insights into security awareness and what's new with CyberCoach.](https://blog.cybercoach.com) ### [Customer Stories Read more about how CyberCoach has helped organizations across different industries modernize their approach to security and AI training. ](https://www.cybercoach.com/customer-stories?hsLang=en) ### [OT Security Training Targeted training for employees working with OT technology.](https://www.cybercoach.com/ot-security-training?hsLang=en) - [AI TRAINING](https://www.cybercoach.com/ai-security-training?hsLang=en) ## [AI Training The most comprehensive role-based AI security and productivity training — built to help employees use AI effectively and safely, and keep your organization compliant with the EU AI Act.](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [AI Security Training Why choose CyberCoach for your AI security training needs?](https://www.cybercoach.com/ai-security-training?hsLang=en) ### [EU AI Act Training Requirements: What You Actually Have To Do AI literacy training has been mandatory since February 2025.  ](https://www.cybercoach.com/eu-ai-act-training-requirements?hsLang=en) - [FOR DEVELOPERS](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ## [For Developers Go beyond OWASP Top10 and offer hands-on interactive training for technical roles in secure coding and efficient use of AI. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) ### [Secure Coding Skills Meet ISO/IEC 27001 or SOC 2 requirements for secure development practices with no-nonsense training for your developers and other technical roles, directly in Microsoft Teams or Slack chat. ](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [COMPANY](https://www.cybercoach.com/about-us?hsLang=en) ## [About us We're growing into the most diverse training platform company on the planet.](https://www.cybercoach.com/about-us?hsLang=en) ### [About Us Get to know our international team.](https://www.cybercoach.com/about-us?hsLang=en) ### [Contact Us Get in touch.](https://www.cybercoach.com/contact-us?hsLang=en) ### [Careers We are hiring.](https://www.cybercoach.com/careers?hsLang=en) ### [Partner with us Learn more about our partner program.](https://www.cybercoach.com/partnerships?hsLang=en) [FREE TRIAL](https://www.cybercoach.com/free-trial?hsLang=en) [GET A DEMO](https://meetings-eu1.hubspot.com/maria-bique/cybercoach-demo?uuid=88959d26-2ff7-4dd0-8ebd-dd43eb31443e) Training # Four Tips for Creating Modern & Effective Security Awareness Training CyberCoach takes a stand against creepy monitoring security awareness training. [Ian Fox](https://blog.cybercoach.com/author/ian-fox) Feb 10, 2023 [Awareness](https://blog.cybercoach.com/tag/awareness) [Training](https://blog.cybercoach.com/tag/training) ### Share this article [mailto:?subject=Check%20out%20https://blog.cybercoach.com/four-tips-for-effective-training&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/four-tips-for-effective-training&utm_medium=social&utm_source=email](mailto:?subject=Check%20out%20https://blog.cybercoach.com/four-tips-for-effective-training&utm_medium=social&utm_source=email%20&body=Check%20out%20https://blog.cybercoach.com/four-tips-for-effective-training&utm_medium=social&utm_source=email) ### Subscribe ### Subscribe ![](https://blog.cybercoach.com/hubfs/greatidea.png)   Companies today face a new reality of cyber threats, as attacks multiply and employees are targeted. Security and IT teams cannot protect businesses alone without collaboration from their broader organizations. As cybercriminals expand their reach and effectiveness using AI and automation, attempts to trick employees are rising.  The pandemic accelerated the need for better workplace security skills, with employees working remotely from varying locations on multiple devices. The line between work and personal devices - already eroding at some workplaces prior to the pandemic - largely disappeared at many companies. Additionally, as companies migrate business functions to the cloud, they become vulnerable to web application attacks and data breaches.  Online security and privacy require more skills and resources than ever before. Basic digital security skills can significantly lower the risk of an individual or business falling victim to cybercrime.  Employers have an important role to play in protecting their employees, and beyond that, an opportunity to help make modern digital society safer.   **What Type of Training do Employees Typically Receive? **  The extent and type of employee training varies significantly depending on geography and industry. For organizations that do offer some form of training, the most common is simulated phishing attacks. These mimic phishing emails and are sent out sporadically to measure how employees respond (as well as to create security awareness). Of the companies that run phishing simulations on their employees, the majority do so only about once per year.  Some employees also receive in-person cyber training on their physical systems/environment from IT colleagues at work. Others are directed to learn additional skills in a classroom setting. A smaller but growing subset of workplaces provide digital skills training in an online platform.     **Workplace Cybersecurity Training Needs to Evolve**    Given the threats we face as well as the opportunities for immersive and interesting digital skills training, the current status quo of cybersecurity training needs to evolve. Some of the key elements of an effective training program include timing, transparency, individuality, and the ability to make mistakes (i.e., not punishing mistakes).  Here are four tips for creating effective and modern workplace cybersecurity awareness training: **1. Timing**  Constantly flooding employee inboxes diminishes their effectiveness. Phishing campaigns should be run occasionally and for limited time only. On the other hand, training should not be a once-annual chore to be completed. It should be a resource in employees’ lives, ideally one they can explore when they have time and that is there to help them when they need it. Providing access to a continuous training environment means that employees are not distracted by fake emails when they are focused on other tasks.     **2. Transparency**  An effective training program should be fully transparent for (and built with input from) employees. They should know a phishing simulation campaign is coming and be offered training if they feel they need it. People learn best through positive reinforcement, not failure. Giving employees training first gives them the chance to succeed.     **3. Individuality**   Training should be tailored to allow for individual learning paths. People lose interest without the freedom to explore topics that interest them. Employers can still have required/mandatory content, while allowing employees to go beyond that material and choose voluntary training on topics that interest them. Ideally, each individual's learning interactions should be as anonymous as possible to allow free exploration of material without fear of judgment. Organizations can still measure overall employee awareness and security culture without personally identifying every training interaction.   **4. No punishment**  Perhaps most importantly, training should not be made into a punishment that people get if they fail a phishing test. Too often, employees that fail are forced to take additional training, which further discourages them. In some programs, employees may even be profiled by algorithms and identified as “high risk”, before being placed in remedial training. Such systems run the risk of embarrassing, demotivating, and alienating employees. This ties into the topic of psychological safety. Making mistakes should be encouraged in a training environment, so people can learn from their mistakes and understand how to adapt their online behavior.    **Looking Forward **  The current scope of employee training, which tends to focus solely on professional topics and assets, does not help employees stay secure in their personal lives. A more holistic approach to security is needed to meet the needs of today's decentralized workplace. Training that helps employees beyond work will also help combat the lack of employee engagement that currently plagues workplace security training. Employers have a significant opportunity to help make their businesses and modern digital society safer. By considering the timing, transparency, individuality, and the learning strategy of their training programs, they can protect their businesses while improving the welfare of their employees and society at large.     ## Similar posts Security Culture ### [Guide to Security Awareness Training for Finance Roles](https://blog.cybercoach.com/guide-to-security-awareness-training-for-defending-financial-data?hsLang=en) Accountants often handle sensitive financial data, making them attractive targets for cybercriminals. What awareness topics should you be training... Maria Bique Feb 29, 2024 Security Culture ### [Guide to role-based security training for salespeople and account managers](https://blog.cybercoach.com/guide-to-role-based-security-training-for-salespeople-and-account-managers?hsLang=en) Discover how targeted security training can empower your sales team to build trust with customers and how we train our salespeople at CyberCoach. Maria Bique Sep 5, 2024 Awareness ### [Four Ways CyberCoach Security Awareness Training Enhances Modern Work Culture](https://blog.cybercoach.com/four-ways-cybercoach-enhances-modern-work-culture?hsLang=en) Discover how CyberCoach's security awareness training empowers modern work culture by embracing autonomy, seamless integration, and building... Maria Bique May 23, 2023 ### Get notified of what's going on in AI and security awareness and compliance **Expert Tips:** Stay informed with curated content, expert opinions, and case studies that are relevant to your organization's security awareness strategy. **Special Offers:** Access to CyberCoach promotions and campaigns.  **Stay Informed:** Get the latest insights and updates on security and AI compliance trends, threats, and best practices delivered directly to your inbox. ![cybercoach_logo_white.svg.2023_03_15_16_58_04.0](https://blog.cybercoach.com/hubfs/cybercoach_logo_white.svg.2023_03_15_16_58_04.0.svg) ### Product - [For Developers](https://www.cybercoach.com/secure-development-training-for-developers?hsLang=en) - [AI Security](https://www.cybercoach.com/ai-security-training?hsLang=en) - [Manage Subscription](https://billing.stripe.com/p/login/28o4jRclF4gab1C6oo) - [FAQ](https://www.cybercoach.com/faq?hsLang=en) ### Connect - [Partner Program](https://www.cybercoach.com/partnerships?hsLang=en) - [Careers](https://www.cybercoach.com/careers?hsLang=en) - [For Media](https://www.cybercoach.com/media?hsLang=en) - [Contact Us](https://www.cybercoach.com/contact-us?hsLang=en) ### Legal - [Privacy](https://www.cybercoach.com/cybercoach-website-privacy?hsLang=en) - [General Terms](https://www.cybercoach.com/general-terms?hsLang=en) ### Company - [About Us](https://www.cybercoach.com/about-us?hsLang=en) - [Blog](https://blog.cybercoach.com) - [ESG Policy](https://www.cybercoach.com/esg-policy?hsLang=en) © 2026 CyberCoach All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Ian Fox", "url" : "https://blog.cybercoach.com/author/ian-fox" }, "dateModified" : "2024-10-04T19:18:05.479Z", "datePublished" : "2023-02-10T21:22:42.000Z", "headline" : "Four Tips for Creating Modern & Effective Security Awareness Training", "image" : [ "https://blog.cybercoach.com/hubfs/greatidea.png" ], "mainEntityOfPage" : { "@id" : "https://blog.cybercoach.com/four-tips-for-effective-training", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.cybercoach.com/hubfs/cybercoach_marketplace_icon.svg" }, "name" : "CyberCoach" } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#organization", "@type" : "Organization", "foundingDate" : "2019", "legalName" : "Cult Security", "logo" : "https://www.cybercoach.com/hubfs/CyberCoach_Full_Logo_Black-2.svg", "name" : "CyberCoach", "sameAs" : [ "https://www.linkedin.com/company/cult-security", "https://x.com/cybercoachUS", "https://www.instagram.com/cybercoachus/", "https://www.youtube.com/@CyberCoachOfficial" ], "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#software", "@type" : "SoftwareApplication", "applicationCategory" : "BusinessApplication", "applicationSubCategory" : "Security awareness and AI skills training", "availableLanguage" : [ "English", "Spanish", "Portuguese (Brazil)", "Portuguese (Portugal)", "French", "Dutch", "German", "Swedish", "Finnish" ], "description" : "CyberCoach is a role-based security awareness, privacy and AI skills training platform that runs as a conversational app inside Microsoft Teams, Slack or a web browser. Employees practice AI skills and responding to social engineering in short, psychologically safe scenario-based sessions. Learning is anonymous while successful completions are recorded per user so the organization can evidence training completion for compliance. CyberCoach can also run on pseudonymous identifiers such as Slack or Microsoft UUIDs, with no personal data shared with CyberCoach.", "featureList" : [ "Conversational phishing and social engineering challenges", "Role-based training programs for technical and non-technical roles", "AI security and AI use training", "Secure coding training for developers", "OT security training", "Custom content creation", "Compliance assessments (ISO/IEC 27001, GDPR, AI compliance)", "Anonymous learning with per-user completion records for compliance", "Optional pseudonymous deployment using Slack or Microsoft UUIDs" ], "name" : "CyberCoach", "offers" : [ { "@type" : "Offer", "description" : "Cover the basics.", "name" : "Starter", "price" : "49", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Broad topic coverage, custom content, hosted kick-off.", "name" : "Advanced", "price" : "159", "priceCurrency" : "EUR" }, { "@type" : "Offer", "description" : "Full coverage, 24/7 AI chat, compliance assessments, hosted kick-off.", "name" : "Complete", "price" : "179", "priceCurrency" : "EUR" } ], "operatingSystem" : "Microsoft Teams, Slack, Web browser, iOS, Android", "publisher" : { "@id" : "https://www.cybercoach.com/#organization" }, "url" : "https://www.cybercoach.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://www.cybercoach.com/#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is a security awareness, privacy and AI skills training platform that runs inside Microsoft Teams, Slack or a web browser. Employees practice role-based skills such as responding to social engineering, ethical and productive use of AI and even secure coding skills in short conversational scenarios. Learning is anonymous, while successful completions are stored so the organization can evidence training completion for compliance frameworks such as ISO/IEC 27001 and SOC 2." }, "name" : "What is CyberCoach?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, but not by sending deceptive emails to employees. CyberCoach uses conversational phishing challenges in which employees practice recognizing and responding to social engineering scenarios in Teams, Slack or the browser. Peer-reviewed research, including Lain et al. (ETH Zurich, 2022 and 2024), finds that traditional email-based simulated phishing does not reduce risk and can increase misplaced trust in the inbox." }, "name" : "Does CyberCoach do phishing tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Learning is anonymous: how an employee answered a training scenario is never visible to managers or administrators. What is recorded is successful completion, so the organization can evidence who has completed required training for compliance purposes. This is privacy by design: the sensitive part of the interaction stays private, and only the completion fact is retained." }, "name" : "Are individual employee answers visible to managers?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes. CyberCoach can be deployed using pseudonymous identifiers, such as Slack or Microsoft UUIDs, so no personal data is shared with CyberCoach. Compliance reporting still works: the mapping between a UUID and a real person is resolved only for authenticated and authorized administrators within the customer's own organization." }, "name" : "Can CyberCoach be used without sharing personal data?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach supports security awareness and secure development training requirements under ISO/IEC 27001 and SOC 2, and includes assessments covering ISO 27001, GDPR and AI compliance on the Complete plan." }, "name" : "Which compliance requirements does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "CyberCoach is available in English, Spanish, Portuguese (Brazil), Portuguese (Portugal), Polish, French, Dutch, German, Swedish, Norwegian, Danish and Finnish, with more languages in development." }, "name" : "Which languages does CyberCoach support?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Plans start at 49 EUR per month for Starter, 159 EUR per month for Advanced and 179 EUR per month for Complete, available monthly or yearly, including through the Microsoft Azure Marketplace." }, "name" : "How much does CyberCoach cost?" } ] } ```