Running a security awareness programme
You analyse audiences and risks, prepare an annual awareness plan and content calendar, design ethical phishing simulations and report behaviour change to management.
Level 201 · 15 lessons · 12 practice labs
Lessons
Programme basics
- Awareness, training and culture
- Behaviour change: knowledge is not enough
- Audiences and role-based risk
- Quick task: a role–risk matrix
Plan and content
- The annual programme plan
- Content formats: short videos, posters, games, stories
- A network of security champions
- Training at onboarding and role changes
- Quick task: a three-month content calendar
Phishing simulation
- The ethics and rules of simulation
- Choosing scenarios and difficulty
- Why the report rate matters more than the click rate
- Quick task: analyse campaign results
Measuring
- Programme metrics and the management report
- Capstone: design a one-year awareness programme
Practice labs
- Awareness, training, culture: Classify twelve activities as awareness, training or culture work.
- A role–risk matrix: Prepare a matrix of the main risks and target behaviour for finance, HR, software and field teams.
- Write behaviour goals, not knowledge goals: Turn eight training goals written as knowledge into observable, measurable behaviour goals.
- Match the format to the audience: Choose short video, poster, game or story for eight message and audience pairs.
- A three-month content calendar: Prepare a twelve-week calendar with weekly topic, format, channel and owner for a retail chain.
- Design a security champions network: Write a design document for Turnalı Perakende covering champion selection, duties, time allowance and incentives.
- Check the simulation rules: Mark ten phishing simulation ideas as acceptable or unacceptable under the ethics rules.
- Choose scenarios and difficulty: Define three simulation scenarios with a difficulty level, to run in your own organisation, for new joiners, finance and executives.
- The simulation rules document: Write the in-house simulation rules covering approval, announcement, data privacy, no punishment and excluded themes.
- Calculate click and report rates: Calculate click and report rates per department from a campaign's raw results table.
- Analyse the campaign results: Compare three campaigns allowing for their difficulty and interpret the trend in time to report.
- A programme report for management: From a year of participation, simulation and incident reporting data, write a one-page report with three metrics, commentary and next-year proposals.
About this course
You analyse audiences and risks, prepare an annual awareness plan and content calendar, design ethical phishing simulations and report behaviour change to management.
What you will learn
- Programme basics
- Plan and content
- Phishing simulation
- Measuring
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.