Security awareness training is a set of short lessons and fake phishing emails that teach a company's employees to recognise attacks and to report them. Sending staff the fake emails is called phishing simulation. The product shows the security team who clicked, who typed a password and who reported the email.
Why train people at all? Filters stop most harmful email, but not all of it. A well-written phishing email that gets past the secure email gateway reaches a person. At that moment, the person's habit decides what happens next.
The product has two parts. The first is a library of lessons, usually a few minutes long and in several languages. They cover topics such as fake invoices, fake login pages and scam calls. A company can assign the lessons through its learning management system (LMS). The second part is the simulator. The security team chooses a template that looks like a real email, picks a group of employees and a date, and the product sends the email. Every click and every typed password is recorded. Nothing is stolen, because the fake login page belongs to the product, and the product does not keep the passwords.
Here is a typical case. An IT services company in Noida with 3,000 employees runs a campaign in October. The fake email says: "Your Diwali bonus letter is ready. Log in to view it." Of the 3,000 employees, 330 click the link, which is 11%. Of these, 90 also type their password. Each of the 330 sees a page at once that explains which signs they missed, and gets a five-minute lesson. Another 400 employees press the "Report phishing" button, which is the habit that the company wants. Three months later, a similar campaign gets clicks from 4% of employees and reports from 25%.
The results matter to auditors as well. Standards such as ISO 27001, and the cyber security rules that Indian regulators set for banks and insurers, expect companies to train their staff and to keep records of it. The product sends these records to compliance automation software, which collects proof for audits. Some sellers offer the training together with policy acknowledgement, in which each employee confirms that they have read the company's rules, and with an ethics hotline through which staff can report wrongdoing.
Training is not meant for blaming people. A company that punishes every click teaches its staff to hide their mistakes. The goal is that an employee who has clicked reports it within minutes, so that the security team can reset the password before the attacker uses it.