Security Awareness Training for Employees

THE ORDINARY TUESDAY

Nobody Here Is Careless. That Is the Problem.

Almost nothing on this list looks like an attack while it is happening. Each one is a normal person doing a reasonable thing in a busy hour. That is exactly why it works, and why a policy nobody reads does not stop any of it.

In any given month, somebody on your team will:
Click a link in an email that looks like it came from you
Approve an MFA prompt they did not request
Pay an invoice after the bank details quietly changed
Reuse a work password on a personal site
Send a client file to the wrong autocompleted address
Read a text from “the CEO” asking for gift cards
Install a browser extension that can read every page
Share a password over chat because it was faster
Give a code to a caller who says they are from IT
Click through a warning banner, because they always do

HOW IT RUNS

We Run the Program. Your Team Takes the Training.

Buying training software is easy. Keeping enrollment current, getting employees to finish their lessons, running phishing tests, and producing the evidence leadership and auditors need takes ongoing work. ITS manages the program for you.

Talk to a Cybersecurity Expert

Baseline first
We phish your team before any training, so you know the real starting number rather than a guess.
Short monthly lessons
Bite-sized modules people actually finish, not a two-hour annual video nobody remembers by March.
Real phishing tests
Simulated emails sent all year, matched to the scams actually hitting businesses like yours.
The report you can hand over
Who trained, who clicked, and how the numbers moved. Written for your board, insurer and auditor.

WHAT YOU GET

Everything in the Program

One price, one team, no platform for you to learn. Everything below is included and managed by ITS.

Phishing Simulation

Realistic test emails sent year-round, with a teachable moment the second someone clicks.

Monthly Micro-Lessons

Five to ten minutes a month, on the scams that are actually circulating right now.

Automatic Enrollment

New starters begin training the week they join. Leavers drop off. No spreadsheet to maintain.

Chasing and Reminders

We follow up the people who have not finished, so completion is not your manager’s problem.

Compliance Reporting

Dated, exportable evidence of who trained and when, in the shape auditors ask for.

A Named ITS Team

People you can call. Not a ticket queue, and not a login and good luck.

COMPLIANCE AND INSURANCE

The Box You Are Already Required to Tick

Security awareness training is not just good practice. It is written into most of the obligations you already carry, and it is on nearly every cyber insurance renewal form. The question at audit is never whether you believe in training. It is whether you can produce the records.

Talk to a Cybersecurity Expert

Colleagues reviewing printed documents beside a laptop, one annotating a page with a highlighter

Frameworks that require it by name:
HIPAA: Security awareness and training is a required administrative safeguard for anyone touching PHI.
PCI DSS: Requirement 12 calls for a formal security awareness program, refreshed at least annually.
CMMC: Awareness and training is one of the named practice families for defense supply-chain work.
FTC Safeguards: Requires security awareness training and refreshers for anyone handling customer information.
Cyber insurance: Most renewal questionnaires now ask directly whether you run training and phishing tests.

If you cannot show dated completion records, an auditor treats the control as absent, whatever your team actually knows.

WHY ITS

We Run This Program on 128 Client Organizations

These are ITS numbers, from our own training platform and our own SOC, not an industry study. The compromise and report figures below are campaign-level: campaigns in which at least one person clicked or reported, not per-person rates.

16,996 learners

Enrolled on the ITS security awareness platform. 10,315 of them are active today.

1,943 phishing campaigns

Simulations run for client teams between March 2023 and August 2026.

19.8% to 47.9%

Campaigns where somebody reported the phish: first campaign against thirteenth. Reporting more than doubles.

288 client organizations

Where our SOC raised a real incident, Feb 2018 to Aug 2026. Size is not a defense.

HONEST ANSWERS

What Buyers Actually Ask Us

1. What is security awareness training?

It is a program that teaches your staff to recognize and report the attacks aimed at them, then tests whether it worked. In practice that means short lessons through the year and simulated phishing emails that create a teachable moment the moment somebody clicks. The training part is common. The testing and reporting part is what separates a real program from a video library.

2. How much does security awareness training cost?

Per user, per month, and it is one of the least expensive controls you can buy. ITS prices it by headcount as part of your security stack rather than as a separate platform subscription, so there is no per-seat creep as you hire. You will get a real number on the first call. What we will not do is quote you a price before we know how many people you have and what you already run.

3. How often should security awareness training be conducted?

Monthly beats annually, by a wide margin. An annual session is forgotten within weeks, and attackers change their approach far faster than once a year. ITS runs short monthly modules with phishing simulations spread across the year, which keeps the topic live without taking real time out of anyone's week.

4. How effective is security awareness training?

Effective enough to be worth doing, and not a silver bullet. Across our own platform, the share of campaigns where somebody reported the phish rises from 19.8% on a client's first campaign to 47.9% by their thirteenth, while the share where somebody was compromised falls from 31.5% to 22.5%. Those are campaign-level figures, not per-person rates. It does not replace technical controls, and anyone promising you a specific percentage before they have baselined your team is guessing.

5. Who is required to complete security awareness training?

Under most frameworks, everyone who touches company systems or data, including part-time staff and often contractors. HIPAA, PCI DSS, CMMC and FTC Safeguards all expect it, and cyber insurers now ask about it at renewal. The practical answer is that carving out exceptions is usually more work than including everyone, and executives are the most targeted group of all.

6. What should security awareness training include?

At minimum: phishing and business email compromise, password and MFA habits, safe handling of customer data, how to report something suspicious, and what to do when a request feels wrong even though it looks legitimate. It should also include simulation, because a program with no test has no way of knowing whether any of it landed.

7. How do you make security awareness training something people finish?

By making it short, relevant and low-drama. Five to ten minutes a month, using examples from scams actually circulating in your industry, beats a two-hour annual video every time. It also helps that somebody other than your office manager is chasing completion. We do that part.

8. Why is security awareness training important?

Most breaches start with a person, not a firewall: a clicked link, a reused password, a convincing fake invoice. Security awareness training closes that gap by teaching employees to recognize and report the tactics attackers actually use, which lowers the odds a single mistake turns into a full incident.

Security Awareness Training
Making Your People Your Security Strength