Security awareness training: building and measuring a programme

Security awareness training covers the actions that teach everyone in the organisation to recognise digital risks and adopt the right reflexes: spotting phishing, protecting their accounts, reporting an incident. Long treated as a yearly formality, it has become an obligation: NIS 2 requires training for management, and DORA makes awareness compulsory for all staff of financial entities. The challenge is to build a programme that genuinely changes behaviour, and to prove it.

There are usually three levels: awareness, aimed at everyone and focused on reflexes; training, more in-depth, for people with a particular role (administrators, developers, procurement, security champions); and practice, through exercises and simulations. A complete programme combines all three.

The goal is not to turn every employee into an expert, but to reduce the mistakes that let attackers in and, above all, to get fast reports. A phishing message reported within minutes lets you block the sender and warn other recipients before they click. That is the best return a programme can deliver, and the idea behind the human firewall.

Recital 89 of NIS 2 sets out the spirit: entities should adopt a wide range of cyber hygiene practices, including user awareness, and organise training for their staff. In France, the transposition law had not yet been passed in early October 2026, but these requirements are in the directive itself.

For artificial intelligence, the AI Act adds an AI literacy obligation for staff using these systems, covered in our article on deployer obligations.

1. Start from the risks. Your risk analysis shows which scenarios involve a human action: phishing leading to stolen credentials, CEO fraud or fake bank detail changes, reused passwords, a lost laptop, data handed to an unapproved tool (shadow IT and shadow AI). The programme targets these scenarios first.
2. Distinguish audiences. Management (training required by NIS 2 and DORA, focused on decisions and crisis management); all staff (basic reflexes); exposed roles: finance and payments, HR, executive assistants, administrators, developers; newcomers; contractors who access your systems.
3. Choose short, regular formats. A few minutes a month stick better than an hour a year. Alternate online modules, small-group workshops, targeted messages after a real incident, crisis exercises for management (see our article on the business continuity plan) and phishing simulations.
4. Make reporting easy. A button in the mail client or a single address, a quick reply and a thank-you every time, including for false alarms.
5. Link it to the rules. Awareness explains the rules of the acceptable use policy and the security policy; it does not replace them. The CISO leads, HR builds the programme into onboarding and the training plan.
6. Plan, budget, document. A yearly calendar, a budget (which DORA explicitly asks management to provide) and evidence kept on file: programmes, attendance lists, results, corrective actions. That is what an auditor or regulator will ask for.

• The Cybermalveillance.gouv.fr awareness kit. The kit from France's national victim support service covers everyday topics: passwords, social network, mobile device and work-personal use security, backups, updates, phishing, ransomware, fake tech support. It comes in several formats (fact sheets, memos, videos, quizzes, comic strip, poster, infographics) and is published under an open licence: you can reuse and adapt it, crediting the source. It is in French.
• ANSSI's SecNumacadémie online course. The agency's free course is being redesigned in 2026, with paths by level and a certificate for each completed path. Meanwhile, existing content remains available on request in a format that can be imported into your organisation's learning platform.
• Cybermois. Every October, as France's version of European Cybersecurity Month, Cybermalveillance.gouv.fr provides resources to organise an internal event. It is a good anchor for a yearly highlight.

The revision of NIST SP 800-50, published in September 2024, gives measuring the impact of learning programmes an important place and proposes a continuous improvement life cycle. In practice, track three families of indicators:

Present these indicators to management as trends, in the security dashboard, rather than as a single percentage. In an ISMS, they feed monitoring and the management review.