SecurityRingBook a Demo

Glossary

What is security awareness training?

A programme that helps employees recognise and respond to cyber threats such as phishing and social engineering, and builds safe habits over time.

How it works

NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program (September 2024), describes a life-cycle approach to awareness, training and education. It says the programme should encourage behaviour change as part of risk management, and it includes suggested metrics and evaluation methods to improve the programme as needs change.

A real example

Regulators increasingly name awareness programmes. SEBI’s CSCRF asks regulated entities to run periodic awareness programmes updated as new threats emerge and to assess employee awareness, for example through phishing test success rate. The UK NCSC adds that training should reassure people they will not get in trouble for reporting.

How to train well

  • Train often and briefly, not once a year.
  • Tie lessons to current attacks and to people’s roles.
  • Keep dated records of who was trained and when.

SecurityRing runs campaigns all year, with in-the-moment lessons and reports you can export as PPT, PDF or CSV for your compliance evidence.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. NISTSP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning ProgramPublished 26 September 2024 · Accessed 17 October 2026.
  2. UK National Cyber Security CentrePhishing attacks: defending your organisationAccessed 17 October 2026.