Security Program Management and Oversight · Topic 7 of 7
Security Awareness Programs
Security+ awareness training: onboarding, ongoing, targeted and corrective training, LMS delivery, behavior risk scoring, BEC, BYOD and OPSEC topics.
- 4 min
- The four training types are initial or onboarding, ongoing, targeted and corrective.
- Targeted training addresses a specific group or risk. Corrective training follows a mistake.
- An LMS delivers courses and tracks completion.
What it is
A security awareness program teaches everyone in the organization to recognize threats and to act safely. People are both a large source of risk and a valuable line of defense.
Technology cannot catch every phishing email or stop every careless act. A good program chooses the right type of training, delivers it in the right way and measures whether behavior actually changes.
How it works
Types of training
| Type | When it is used |
|---|---|
| Initial or onboarding | When a person joins, before or soon after they receive access |
| Ongoing | On a regular schedule to refresh knowledge and cover new threats |
| Targeted | For a specific group or risk, such as finance staff and payment fraud, or administrators and privileged access |
| Corrective | After a mistake or failed test, such as clicking a simulated phishing link |
Corrective training should teach, not punish. Staff who fear blame stop reporting their mistakes, and unreported mistakes are the most dangerous kind.
Delivery mechanisms
| Mechanism | Meaning |
|---|---|
| Learning management system (LMS) | A platform that delivers courses, tracks completion and records scores |
| Self-service portals | A place where staff find guidance, short videos and reporting tools when they need them |
| One-to-one | Personal coaching, often used for corrective training or senior staff |
| One-to-many | A single session for a large audience, such as a webinar or all hands briefing |
An LMS gives the records that auditors and managers ask for. One-to-one sessions take more effort, so they are kept for high risk individuals.
Reporting and monitoring of effectiveness
| Item | Meaning |
|---|---|
| Metrics | Measures such as completion rates, simulated phishing click rates, reporting rates and time to report |
| Managerial reports | Summaries for managers showing their team's completion and results |
| Personnel behavior risk scoring | A score for each person based on behavior, such as repeated clicks or policy breaches, used to target training |
Completion shows attendance, not change. A falling click rate and a rising report rate show that the program is working.
Common training topics
| Topic | Key message |
|---|---|
| Social engineering | Verify unusual requests, especially for money, access or data |
| Emerging security topics | New threats, such as deepfake voice or video used in fraud |
| Password and credential management | Long, unique passwords, a password manager and multifactor authentication |
| Remote work, teleworking and hybrid | Secure home networks, lock screens and avoid public Wi-Fi without a VPN |
| Bring your own device (BYOD) | Follow the BYOD policy, keep personal devices updated and enrolled |
| Business email compromise (BEC) | Confirm payment or bank detail changes through a known channel, not by replying |
| Removable media and cables | Do not plug in unknown USB drives or charging cables |
| Situational awareness | Notice what is around you, such as tailgaters or people reading your screen |
| Operational security (OPSEC) | Do not reveal small details that together help an attacker |
Business email compromise uses a real or spoofed business email account to trick staff into sending money or data. The best defense is a call back to a known phone number before any payment change.
OPSEC means avoiding the release of details such as project names, travel plans or system names, especially on social media.
How the exam asks about this
- "An employee clicked three simulated phishing links this quarter." -> Corrective, one-to-one training, guided by a behavior risk score.
- "Accounts payable staff need to resist fake invoice and bank change emails." -> Targeted training on business email compromise.
- "Leadership wants to know whether awareness training is working." -> Metrics such as phishing click and report rates over time.
What to remember for the exam
- The four training types are initial or onboarding, ongoing, targeted and corrective.
- Targeted training addresses a specific group or risk. Corrective training follows a mistake.
- An LMS delivers courses and tracks completion.
- One-to-one suits individuals, and one-to-many suits large audiences.
- Metrics include click rates, report rates and completion rates.
- Behavior risk scoring identifies the people who need more training.
- BEC defense is verifying payment changes through a known channel.
- OPSEC means not leaking small details that help an attacker.
When a question asks how to measure whether awareness training works, look for phishing click rates and report rates over time, not just completion.
Common mistakes
Punishing staff who click simulated phishing. This discourages reporting. Use corrective training instead.
Relying on one yearly course. People forget, so ongoing training matters.
Treating all staff alike. Roles face different risks and need targeted content.
Measuring only completion. Completion shows attendance, not behavior change.
Forgetting removable media. Unknown USB drives and cables are a real route for malware.
Do not tell staff to delete suspicious messages quietly. They should report them, so the security team can protect others who received the same message.
Check yourself
Which type of training follows an employee's failed phishing simulation?
Corrective training.
What does personnel behavior risk scoring do?
It rates each person's risk from their behavior so that training can be targeted where it is needed.
What is the best defense against a business email compromise payment request?
Verify the request through a known, separate channel, such as calling a known phone number.
Topic 7 of 7 in Security Program Management and Oversight
Test yourself on Security Program Management and Oversight
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.