for good cyber security awareness training. Ideally the training should be iterative – it’s not a course on day two of induction and the problem is solved. People need on-going engagement and commitment. A basic course should be backed up by refresher sessions (perhaps phishing campaigns where the staff of an organisation are safely phished by their training provider) and on-going reminders of important issues (possibly through poster campaigns or similar).
Good cyber security awareness training doesn’t only teach, it creates a security culture. And, as I’ve said already, companies that invest in training and develop such a culture, suffer fewer and less damaging cyber-attacks.