One video a year
doesn’t change what someone clicks on
in month eleven.
your IT provider isn’t pushing one training platform. Here’s what actually changes behavior versus what just checks a compliance box.
Find your training model before you talk to a vendor
A few quick questions. We'll highlight the closest fit below, then you can read why.
Three training models, three different outcomes
Vendors bundle these differently and brand them however marketing wants that quarter. The underlying outcome each one produces is what actually matters.
Annual Compliance Training
One video a year, tracked for a checkbox.
- Simplest to buy and administer
- Almost no measurable effect on behavior
- Satisfies the letter of most compliance requirements
Continuous Micro-Training
Short, frequent modules spread throughout the year.
- Higher retention than one long annual session
- Requires ongoing time from employees
- Better fit for building lasting habits
Simulated Phishing + Training
Ongoing fake phishing tests paired with just-in-time coaching.
- Measurable click-rate improvement over time
- Requires a program, not a one-time purchase
- The closest thing to proof it’s actually working
12 questions to ask any security awareness training vendor
Click each one off as you go. Bring what's left to the sales call, a vendor who gets defensive about any of these is telling you something.
Is training a single annual video or ongoing throughout the year?
Are employees tested with real simulated phishing not just quizzed on slides?
What happens when someone clicks a simulated phishing link, coaching or punishment?
Is content updated for current trends or the same video every year?
Can you see click rates trending down over time, with real data?
Does it cover your industry’s specific risks not just generic advice?
Is it engaging enough that people don’t just click through to finish?
Does leadership take the same training as everyone else?
How long does a typical module take realistically, for a busy employee?
Is reporting audit-ready for compliance or cyber insurance requirements?
Are new hires trained on day one or day ninety?
Can you get a straight answer to all eleven questions above, in writing?
6 signs your security awareness training is a liability, not a defense
These show up constantly in businesses that thought they were covered.
The same training video has been used for three years running.
Nobody can produce a click-rate report from the last phishing test.
New hires have full system access before completing any training.
Completion is tracked, but nobody checks whether behavior changed.
Leadership is exempt from the training everyone else has to sit through.
A "test" was announced in advance, so results don’t reflect reality.
The buzzwords, decoded
We’ll look at what you actually have, then tell you the truth about it.
No vendor commission riding on the answer. Just a straight read on whether training is actually working.
Get a Training Effectiveness CheckGet in touch with Your Company
Questions about this solution? Reach us directly.