# Security Awareness Training: How to Build a Programme That Changes Behaviour in 7 Steps

> How to build security awareness training in 7 steps: role-specific content, phishing simulations, reporting-rate metrics and a sample 12-month plan.

Source: https://digitalbridge.com.tr/en/blog/security-awareness-training-program.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Cyber Security & Compliance
Published: 2026-10-29 · Updated: 2026-10-29

Security awareness training is an ongoing programme that turns the right response to [phishing](https://digitalbridge.com.tr/en/glossary.html#phishing), social engineering, password and data-sharing risks into a habit for every employee. A programme that works is not an annual presentation: it combines short role-specific content, regular simulations, one easy reporting channel and metrics that track behaviour rather than attendance.

## Key takeaways

- Security awareness training is not an annual presentation; it is a programme of five-to-ten-minute, role-specific monthly modules.
- According to the Verizon 2026 DBIR, the human element was present in 62% of breaches; training must cover SMS and phone as well as email.
- Phishing simulations should run every one or two months, without blame, with difficulty raised step by step.
- The most valuable metric is not the click rate but the share of staff who report suspicious messages and the time to first report.
- KVKK does not list training as a separate item, but staff training is an easily documented administrative measure; NIS2 makes it mandatory for management.

## Why does awareness training fail at most companies?

With security awareness training, the pattern is familiar. Once a year, usually just before an audit or a customer questionnaire, staff sit through an hour-long presentation, sign an attendance sheet and go back to work. Three months later someone in accounts answers an "urgent" payment request, and nothing from the session comes to mind at the moment it matters.

The problem is rarely employee indifference; it is programme design. An hour of dense content fades within weeks, generic examples look nothing like the employee's own inbox, and a person who was embarrassed for clicking last time stays quiet rather than reporting the next suspicious message. Our guide on [how to spot phishing emails](https://digitalbridge.com.tr/en/blog/how-to-spot-phishing-emails.html) covers the warning signs themselves; this article is about the programme that makes those signs stick.

## What does an untrained team cost a business?

As of 2026, most cyber attacks still pass through a human decision. According to the [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf), the human element was present in 62% of breaches, up slightly from 60% the previous year. The same report found the median click rate in email phishing simulations was 1.4%, while phone-centric methods such as SMS and voice were closer to 2%, which means training has to cover the phone as well as the inbox.

> According to the UK government's [Cyber Security Breaches Survey 2025/2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), 43% of businesses experienced a cyber breach or attack in the previous 12 months, with phishing by far the most common type (38% of businesses).

Attackers are also using AI to get better at the craft. [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20Threat%20Landscape%202025_v1.2.pdf) notes that, according to the sources it cites, over 80% of phishing emails identified between September 2024 and February 2025 used AI to some extent. Training material that teaches people to look for spelling mistakes is therefore out of date.

Credentials tell the same story. In [Sophos' The State of Identity Security 2026](https://www.sophos.com/en-us/press/press-releases/2026/05/71-percent-organizations-suffered-identity-breach-state-of-identity-security-2026) survey of 5,000 IT and security leaders in 17 countries, 71% of organisations reported at least one identity-related breach in the past year, and employees tricked into handing over credentials were cited in nearly 43% of incidents.

Yet training remains the exception rather than the rule. The same UK survey found that only 19% of businesses had provided any form of cyber security training to staff in the past year, rising to 84% among large businesses. The risk is similar at every size; the preparation is concentrated at the top.

## Is security awareness training a legal requirement?

Under [KVKK's data security obligations](https://www.kvkk.gov.tr/Icerik/2040/Veri-Guvenligine-Iliskin-Yukumlulukler), the Turkish data protection law requires data controllers to take all necessary technical and administrative measures to ensure an appropriate level of security, and the Authority has published a Personal Data Security Guide to spell those measures out. The law does not prescribe the format or frequency of training, but staff training is one of the most easily documented administrative measures.

In the European Union, the [NIS2](https://digitalbridge.com.tr/en/glossary.html#nis2) [Directive on the security of network and information systems (EU 2022/2555)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555) is more explicit: Article 20(2) requires members of the management bodies of in-scope essential and important entities to follow cybersecurity training and encourages entities to train employees regularly, while Article 21 lists basic cyber hygiene and cybersecurity training among the minimum risk-management measures.

The NIS2 Directive does not apply directly to Turkish companies, but in-scope EU customers may pass these expectations on to suppliers through contracts and supplier questionnaires as part of supply chain security; confirm your own position with legal counsel.

## How do you build a security awareness training programme? 7 steps

An effective security awareness programme is built in the following seven steps, in order:

1. **Map your high-risk roles.** Accounts staff who approve payments, buyers who deal with suppliers, HR teams handling personal data, executive assistants and IT administrators face different threats. Write down the three most likely scenarios for each role; for accounts staff and executive assistants the first is usually [CEO fraud](https://digitalbridge.com.tr/en/blog/what-is-ceo-fraud.html).
2. **Keep content short and role-specific.** Replace the annual hour with five-to-ten-minute monthly modules. Use examples that look like real work: [bank detail change fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html) for finance, a fake quotation for purchasing, a malicious "CV" for HR.
3. **Give people one way to report.** Everyone should know exactly where to send a suspicious email, call or USB stick. If reporting is awkward, the training is wasted. For a module on dangerous file types, our guide to [malicious email attachments](https://digitalbridge.com.tr/en/blog/malicious-email-attachments.html) makes a ready source.
4. **Run simulations regularly and without blame.** Send a phishing simulation every one or two months, gradually raising the difficulty. Show anyone who clicks a short, non-judgemental explanation straight away.
5. **Pair training with technical controls.** Training does not replace [multi-factor authentication](https://digitalbridge.com.tr/en/blog/multi-factor-authentication-business.html) or a sound [business password policy](https://digitalbridge.com.tr/en/blog/business-password-security.html); you still need layers that limit the damage when someone slips.
6. **Build it into joining and leaving.** New starters complete the core module in their first week; leavers lose access on their last day. We cover the account side in our guide to [offboarding email access](https://digitalbridge.com.tr/en/blog/offboarding-email-access.html).
7. **Measure behaviour, not attendance.** A signed sheet proves compliance, not reduced risk. Report the metrics below to management every quarter. Keep attendance records digital all the same; the method is described in [digital tracking of OHS training records](https://digitalbridge.com.tr/en/blog/ohs-training-records-digital-tracking.html).

### Which awareness training metrics actually tell you something?

| Metric | What it shows | How to read it |
|---|---|---|
| Completion rate | Who finished the module | Necessary, but says nothing about behaviour |
| Simulation click rate | Share of people who took the bait | Swings with scenario difficulty; misleading on its own |
| Reporting rate | Share of people who reported the message | The most valuable signal; you want it rising |
| Time to first report | Minutes from launch to the first report | Drives how fast you can respond to a real attack |
| Repeat clickers | Same person failing several campaigns | Flags who needs one-to-one support |
| Real-world reports | Suspicious emails reported outside simulations | Shows the habit has taken hold |

Driving the click rate to zero is not a realistic goal; a well-crafted lure will catch anyone eventually. The real goal is that whoever spots the lure, or falls for it, raises the alarm within minutes. The higher your reporting rate, the smaller the damage from a genuine attack.

## What topics should security awareness training cover?

Phishing is the core topic of awareness training, but not the only one. Splitting the year into four themes keeps the content balanced:

- **Email and messaging:** phishing, [lookalike domain attacks](https://digitalbridge.com.tr/en/blog/lookalike-domain-attacks.html), fake invoices and payment diversion, plus social engineering by text message and phone, and what to do about an [email sent to the wrong recipient](https://digitalbridge.com.tr/en/blog/email-sent-to-wrong-recipient.html).
- **Identity and access:** never sharing passwords, not approving MFA prompts you did not trigger, locking shared computers.
- **Data and AI tools:** which customer and employee data may go into which tool. We set out the reasoning in [ChatGPT and company data security](https://digitalbridge.com.tr/en/blog/chatgpt-company-data-security.html).
- **Physical security:** not holding the door for strangers, escorting visitors, keeping desks clear of documents. Our [turnstile types guide](https://digitalbridge.com.tr/en/blog/turnstile-types-guide.html) explains which gates can detect tailgating.

### A sample 12-month awareness training plan

| Period | Theme | Simulation |
|---|---|---|
| Months 1–3 | Phishing basics, reporting channel | Easy email lure |
| Months 4–6 | Payment and supplier fraud | Role-specific (finance, purchasing) |
| Months 7–9 | Identity, passwords, AI use | Phone or SMS scenario |
| Months 10–12 | Physical security, incident drill | Hard lure in realistic business language |

Close the year with a tabletop exercise: "Finance has just paid a fraudulent account; what happens now?" Walk through it with management, IT and legal. If personal data is involved, the drill is also where you confirm how the [72-hour breach notification under KVKK](https://digitalbridge.com.tr/en/blog/data-breach-72-hours-kvkk.html) would work in practice.

## How does Digital Bridge build an awareness programme?

Digital Bridge does not sell an off-the-shelf video library; it builds the awareness programme around each organisation's actual risks:

- **Discovery and risk map.** Through our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html) we identify which roles are exposed to which attacks, review your reporting channel and check the technical protection on your email. We use our [SME cyber security checklist](https://digitalbridge.com.tr/en/blog/sme-cyber-security-checklist.html) to capture the wider picture.
- **Pilot group.** We start with one high-risk department, typically finance and purchasing, for a three-month pilot. Scenarios mirror your own suppliers and correspondence style, and we compare the reporting rate against a baseline.
- **Compliance and documentation.** We align training records, policies and the incident procedure with your [data protection compliance](https://digitalbridge.com.tr/en/consultancy/data-protection-compliance.html) work and, where relevant, with your [ISO 27001 preparation](https://digitalbridge.com.tr/en/blog/iso-27001-guide-for-smes.html).
- **Rules for AI use.** We add guidance on chat tools to the programme and, where a safe alternative is needed, assess an [enterprise LLM assistant](https://digitalbridge.com.tr/en/technology-hardware/enterprise-llm-assistant.html) that keeps company data in-house.

## How does Smart360 carry awareness training into daily work?

What people learn in awareness training only survives a busy day if their tools reinforce it. [**SmartMail**, the business email product](https://digitalbridge.com.tr/en/smart360/smartmail.html) in our own [Smart360](https://digitalbridge.com.tr/en/smart360.html) family, assesses every incoming message in three groups of checks: identity (SPF/DKIM/DMARC and PTR, recalculated by SmartMail itself), structure (lookalike domains and international-character spoofing, display-name and brand impersonation, reply-address and link mismatches) and content (the full text, assessed with AI). The result is an explained assessment next to the sender's name that shows which signal raised the risk, so the employee sees, for example, "reply address differs; domain imitates a known contact" at the moment of decision and practises the training on a real message.

In SmartMail's shared mailboxes, team notes and the call-attention feature let someone point a colleague to a suspicious message on the same screen. Remote images stay blocked until allowed, and messages sent on the company's behalf can be routed to one or more approvers before they go out. The company administrator sets the quarantine threshold, and the messages a new threshold would affect are listed before it is saved.

On the identity side, SmartID gives one sign-in across the Smart360 products. In Smart360, mailbox passwords are generated by the system and never handed out to staff, which backs up the "never share your password" rule technically. Sessions are listed with device details and can be ended remotely, and a leaver's access is closed from a single place. Smart360 Security protects login screens against bot traffic: a sign-in request does not reach the server until human verification is complete.

## How can you start an awareness programme this week?

You do not need a big budget to start a security awareness programme. This week, write down your three highest-risk roles and the single channel staff should use to report a suspicious message. Then [get in touch with us](https://digitalbridge.com.tr/en/contact.html): we will choose a pilot department together, set up the measurement plan for the first simulation and show SmartMail's explained security analysis on your own addresses. To buy SmartMail, use the [Smart360 Buy Now page](https://smart360.com.tr/satin-al?urun=smartmail); packages are listed on SmartMail.com.tr. For related topics, browse our [Cyber Security & Compliance guides](https://digitalbridge.com.tr/en/blog/topic/guvenlik-kvkk.html).

## Frequently Asked Questions

### How often should security awareness training take place?

Short monthly modules of five to ten minutes, plus a phishing simulation every one or two months, produce more lasting results than one long annual session. New starters should complete a core module in their first week. Roles that approve payments or handle personal data benefit from at least one additional role-specific session each year.

### Do phishing simulations upset employees?

They can if they are used to catch people out and punish them, which damages trust and reduces reporting. Programmes that are announced in advance, explain their purpose and show a short learning note to anyone who clicks are generally well received. Results should be reported to management by department, with the reporting rate highlighted rather than individual names.

### How do we know whether the training is working?

Look at behaviour rather than attendance: the share of staff who report suspicious messages, the time from a campaign's launch to the first report, repeat clickers and genuine suspicious emails reported outside simulations. The quarterly trend in these indicators gives a far more reliable picture than the click rate of any single campaign.

### Does Turkish data protection law require awareness training?

KVKK requires data controllers to take appropriate technical and administrative measures to keep personal data secure, and the Authority has published a data security guide describing them. The law does not regulate training as a separate item, but staff training is one of the most easily documented administrative measures. Keeping records of when training took place, what it covered and who attended helps an organisation demonstrate due care if a breach is investigated.

### What drives the cost of security awareness training?

The main cost factors are headcount, the number of role-specific scenarios, how often simulations run, whether content is off-the-shelf or tailored to your organisation, languages and formats, reporting requirements and whether the programme must tie into KVKK or ISO 27001 documentation. Starting with a single-department pilot lets you scale the budget in line with measured results.

### How can a small company get started?

Identify your high-risk roles and a single reporting channel, then run a three-month pilot with one department. Short examples based on your own correspondence are enough for content. Once the pilot's results are in, extend the programme to other departments and increase simulation difficulty step by step.

### Should the phishing simulation click rate fall to zero?

No, driving the click rate to zero is not a realistic goal; a well-crafted lure will catch anyone eventually. According to the Verizon 2026 DBIR, the median click rate in email phishing simulations is 1.4%. The real goal is that whoever spots the lure, or falls for it, raises the alarm within minutes; the higher the reporting rate, the smaller the damage from a genuine attack.