One clever email can hand your company's data to a criminal — and it happens every day. Security awareness and training is the human firewall that stops those tricks before they reach the technology. For the CC exam, you need to understand that people are the most targeted part of any security system, and teaching them to spot attacks is as critical as any firewall or encryption tool.
Jump to a section
A simple way to picture Security Awareness and Training
A busy coffee shop on a morning rush.
The manager hires Sarah for the register. Before her first day, she gets a quick briefing: "Never leave the cash drawer open, always check that the customer's card is real, and if someone tries to distract you while you're handling money, close the drawer first." Sarah nods, but on her second day, a friendly regular starts chatting loudly about her dog while Sarah is counting change. Distracted, Sarah leaves the drawer open. In that moment, a stranger in a hoodie reaches over and grabs a handful of bills. The shop loses eighty dollars.
That loss happens because Sarah wasn't trained to recognise the distraction as a tactic. The manager didn't just need to teach Sarah how to press buttons on the register — she needed to build Sarah's awareness of how thieves operate. The training was the policy; the awareness was the instinct to spot the setup.
In IT, the cash drawer is the organisation's data — customer records, financial files, login credentials. The distractions are social engineering attacks: emails that look urgent, phone callers pretending to be the CEO, strangers walking into the office behind an employee through a door. Security awareness training is the practice of teaching every employee to recognise those setups and react automatically, before the money — or the data — walks out the door.
Security awareness and training is the process of educating people inside an organisation — employees, contractors, managers — to recognise, avoid, and report security threats. It exists because the most expensive security technology in the world becomes useless the moment an employee clicks a malicious link or hands their password to a stranger on the phone.
The core idea is simple: attackers don't just try to break through technology; they try to trick people. This is called social engineering. Social engineering is a psychological manipulation technique where an attacker tricks a person into breaking normal security procedures. For example, an attacker might call an employee, pretend to be from IT support, and say: "We're doing a system update — can you confirm your password so we don't lock you out?" The employee, wanting to be helpful, gives away their login credentials. The attacker now has access to the internal network.
Security awareness training aims to stop this. It covers several key areas:
Recognising phishing emails: Phishing is a type of attack where the attacker sends a fake email that looks like it comes from a trusted source (a bank, the boss, a supplier). The email tries to trick the recipient into clicking a link that installs malware (malicious software) or entering their username and password into a fake website.
Recognising pretexting: Pretexting is when an attacker creates a made-up scenario (a "pretext") to steal information. For instance, someone might call pretending to be from HR and ask for your home address, claiming they need it for an insurance form.
Recognising baiting: Baiting involves offering something enticing, like a free music download or a USB drive labelled "Confidential" left in the car park. When the victim takes the bait, malware is installed on their device.
Recognising tailgating: Tailgating (or piggybacking) is when an unauthorised person follows an authorised person through a secure door without using their own access card.
Understanding password security: Not reusing passwords across sites, not writing them on sticky notes, and not sharing them with anyone, even if the person claims to be IT.
Reporting incidents: Every employee should know exactly how to report a suspicious email or phone call to the security team without feeling embarrassed.
Why does this matter more than technology alone? Because attackers adapt. If they cannot break through the firewall, they target the person who has legitimate access. According to real-world incident data, the majority of data breaches involve a human element — an employee making a mistake. Training turns that human element from a vulnerability into a defence.
The training is typically delivered in several ways:
Initial onboarding training: When a new employee joins, they complete a basic security course before they get access to company systems.
Annual refresher training: Once a year, all employees repeat the core lessons and learn about new attack types.
Simulated phishing campaigns: The IT security team sends fake phishing emails to employees to test whether they click. If someone clicks, they are given additional training, not punishment.
Posters, newsletters, and desk drops: Simple reminders keep security top of mind.
The concept replaces the old belief that security is only an IT problem. In the modern organisation, security is everyone's responsibility. The cleaning staff, the receptionist, and the CEO all need training because they all have access to the building, the network, or the data.
One key term for the exam is the "security awareness programme." This is the structured set of activities an organisation uses to keep employees informed and alert. It is not a one-time event; it is a continuous process because the threats change constantly.
Another important term is "due care and due diligence." Due care means that the organisation is taking reasonable steps to protect its data — and one of those steps is training employees. If a company does not train its staff and a breach happens, the company could face legal liability for not exercising due care. Due diligence is the ongoing effort to verify that the training is being followed and that the security controls are working.
Finally, security awareness training is documented. Organisations keep records of who attended, when they attended, and what topics were covered. This documentation is critical for compliance with regulations like GDPR (General Data Protection Regulation) or HIPAA (Health Insurance Portability and Accountability Act). If an auditor asks, the company needs to prove that training happened.
Assess the organisation's current risk posture
Before any training begins, the security team evaluates what data is most sensitive, what types of attacks the organisation has faced in the past, and which roles (e.g., finance, HR) are highest-risk. This determines the focus of the training content.
Develop or procure training materials
The team creates or buys a training programme that covers core topics: recognising phishing emails, safe password practices, physical security (tailgating), and incident reporting procedures. The content must match the organisation's specific threat landscape.
Deliver initial onboarding training
Every new hire completes the training before they gain access to company systems. This ensures a baseline level of awareness from day one. The training includes a quiz to confirm understanding.
Conduct simulated phishing exercises
The security team sends fake phishing emails to employees at regular intervals (e.g., quarterly). The goal is to test whether employees apply what they learned. Anyone who clicks a simulated link receives immediate, non-punitive corrective training.
Track and measure training effectiveness
The team collects metrics: percentage of employees who completed training, click-through rates on simulated phishes, number of real threats reported by employees. These metrics are reported to leadership and used to improve the programme.
Deliver annual refresher training and continuous awareness
Once a year, all employees repeat a condensed version of the training. Throughout the year, the team sends regular reminders (newsletters, posters, short videos) to keep security top of mind. This step maintains the awareness level over time.
Update the programme based on new threats
As new social engineering tactics emerge (e.g., deepfake voice calls), the training content is updated. The programme is never static; it evolves with the threat landscape to stay relevant.
Meet Carla, the IT security manager at a mid-sized accounting firm with 200 employees. She has a firewall, antivirus software, and multi-factor authentication (MFA) in place. But she knows that none of that matters if one employee opens a fake invoice email.
Step one: Carla builds the security awareness programme. She negotiates with a vendor that provides a training platform. The platform has short videos, quizzes, and simulated phishing emails. She books a training session for every employee during their first week. The videos cover: how to spot a phishing email, why you never share a password, how to verify someone's identity on the phone, and what to do if you see a stranger in the building.
Step two: Carla sends out a simulated phishing email to all employees. She creates a fake message that looks like it comes from "The CEO's Office" with a link to "Review the new bonus policy." She tracks who clicks. Forty employees click the link — that is 20 percent of the workforce. She does not punish them. Instead, she sends each person a brief, friendly reminder about phishing and a link to a two-minute video.
Step three: A real attack happens. An employee, Tom, receives an email that appears to come from a major client. The email says: "We've updated our payment portal. Please log in with your usual credentials here [link] to confirm the next wire transfer." Tom remembers Carla's training. He checks the email address — it is "support@cient-portal.com" instead of "support@client-portal.com." He hovers over the link without clicking and sees it points to a strange website. Instead of clicking, Tom forward the email to Carla's security team with the subject line "Suspicious email." The attack is stopped.
Step four: A new employee, Priya, starts. During her onboarding, Carla includes training on tailgating. Priya learns: if someone she does not recognise tries to follow her through the secure door, she should politely ask them to badge in separately. Two weeks later, a man carrying heavy boxes approaches the door. He smiles at Priya and says, "Can you hold the door? My hands are full." Priya says, "Sure, I'll badge you in myself — you can use my badge this one time." Then she realises the training said never to do that. She stops, tells the man she cannot let him in without his own badge, and directs him to reception. The man leaves quickly. Later, security review footage and see the same man trying doors in the car park. Priya's training prevented a potential break-in.
Carla runs an annual report for the board. She documents: how many trainings were completed, how many simulated phish attempts were caught, how many actual incidents were reported by employees. The board sees that the human firewall is working. The firm's cyber insurance premium goes down because they can prove they have a training programme in place. This is due care in action.
What does Carla actually do day-to-day? - She reviews the latest phishing trends from threat intelligence feeds and updates the training content every quarter. - She sends out monthly "Security Spotlight" emails with one tip and a short video link. - She runs a simulated phishing campaign every two months and tracks the "click rate" — the goal is to get it below 5 percent. - She conducts in-person workshops for high-risk departments (finance, HR) who handle sensitive data. - She meets with each new hire within their first week to explain the reporting process.
Carla's work is never finished. New employees join, threats evolve, and old employees forget. Security awareness is a continuous process, not a checkbox.
The CC exam will test your understanding of security awareness and training in several specific ways. First, know the difference between "security awareness" and "security training." Awareness is the ongoing state of being alert to threats. Training is the formal instruction that builds that awareness. The exam loves to ask: "What is the primary goal of security awareness training?" The answer is: to change employee behaviour and reduce human error.
Second, the exam will expect you to recognise the different types of social engineering attacks. You need to be able to identify a description and label it as phishing, vishing (voice phishing), smishing (SMS phishing), pretexting, baiting, tailgating, or shoulder surfing (looking over someone's shoulder to steal a password). They often give a short story and ask: "Which type of social engineering is this?"
Third, the exam tests the concept of "due care." They might phrase it as: "Which legal principle requires an organisation to implement security awareness training?" The answer is due care. They will also test "due diligence" as the ongoing verification that the training is effective. Be ready to distinguish these two terms.
Fourth, know what a "security awareness programme" includes. The exam materials list several components:
Policy and procedures documentation
Initial and ongoing training
Simulated phishing exercises
Incident reporting mechanisms
Continuous communication (posters, emails, newsletters)
Metrics to measure effectiveness
They will ask: "Which of the following is NOT typically part of a security awareness programme?" and give options like "firewall configuration" or "employee onboarding training." The correct answer will be the one that is a technical control, not a people-focused activity.
Fifth, the exam likes to test "reporting procedures." They want you to know that employees should report suspicious activity immediately to the security team or through a designated channel, without fear of punishment. The trap is a question that says: "An employee receives a suspicious email. What should they do first?" Wrong answers include: "Delete it immediately" or "Reply to ask who sent it." The correct answer is: "Report it to the security team according to company policy."
Sixth, they will test the concept of "single point of failure." In the context of security awareness, one untrained employee can be the single point of failure that allows a breach. Training helps eliminate that weak link.
Key definitions to memorise for the exam:
Social engineering: Manipulating people into breaking security procedures.
Phishing: A fraudulent email that attempts to trick the recipient into revealing sensitive information or installing malware.
Pretexting: Creating a fabricated scenario to steal information.
Baiting: Offering something appealing to lure a victim into installing malware.
Tailgating: Following an authorised person through a secure door without proper credentials.
Shoulder surfing: Watching someone enter their password or PIN over their shoulder.
Security awareness programme: A structured set of activities to keep employees informed about security risks and how to avoid them.
Due care: The legal responsibility to take reasonable steps to protect sensitive information, including training employees.
Due diligence: The ongoing effort to monitor and verify that security controls (including training) are effective.
The traps on the exam often involve mixing up the types of social engineering. For example, they might describe a scenario where someone calls pretending to be from IT — that is vishing, not phishing. If the scenario involves a fake email, it is phishing. If it involves a text message, it is smishing. If it involves a USB stick left in a car park, it is baiting. Memorise these categories precisely.
Another trap: they might ask who is responsible for security awareness. The wrong answer is "only the IT department." The correct answer is "everyone in the organisation, from the CEO to the newest employee."
Finally, know that security awareness training is a form of administrative control. The three types of controls are: administrative (policies, training), technical (firewalls, encryption), and physical (locks, guards). The exam will ask you to classify training as an administrative control.
Security awareness training is a continuous process, not a one-time event, because threats evolve constantly.
Social engineering exploits human psychology, not technology, making training the most critical defence against it.
Phishing, vishing, smishing, pretexting, baiting, and tailgating are the six main types of social engineering you must recognise for the CC exam.
Every employee in an organisation is responsible for security, from the CEO to the receptionist, and each needs role-appropriate training.
A no-blame culture for reporting suspicious activity encourages employees to come forward without fear, which stops attacks faster.
Due care is the legal principle that requires organisations to take reasonable steps like training to protect data; due diligence verifies that training works.
Security awareness training is classified as an administrative control, distinct from technical controls (firewalls) and physical controls (locks).
Simulated phishing campaigns measure the effectiveness of training and identify employees who need additional support.
These come up on the exam all the time. Here's how to tell them apart.
Security Awareness
An ongoing state of being alert to threats
Built through continuous reminders and culture
Measured by behaviour and reporting rates
Security Training
A discrete formal instruction event
Delivered as courses, videos, or workshops
Measured by completion rates and quiz scores
Phishing
Uses fake emails to trick victims
Usually involves clicking a link or downloading an attachment
Mass-distributed to many recipients
Pretexting
Involves creating a false scenario or identity
Often done via phone call or in person
Targets a specific person with personalized story
Due Care
The initial responsibility to take reasonable security steps
Often legally mandated for protecting data
Includes implementing a security awareness programme
Due Diligence
The ongoing verification that controls are effective
Includes auditing training records and test results
Ensures the programme remains adequate over time
Tailgating
Involves following someone through a secure door
Physical access attack
Exploits politeness or distraction
Shoulder Surfing
Involves looking over someone's shoulder to see a password or PIN
Information theft attack
Exploits lack of privacy in public spaces
Administrative Control
Involves policies, procedures, and training
Focuses on people and processes
Examples: security awareness programme, incident response plan
Technical Control
Involves hardware and software solutions
Focuses on technology
Examples: firewall, encryption, multi-factor authentication
Mistake
Security awareness training is a one-time thing you do when you join the company, and then you are done.
Correct
Security awareness must be continuous and updated regularly because attackers change their methods. Annual refreshers and simulated phishing tests keep it effective.
Beginners assume that once trained, people remember everything forever. But in reality, humans forget, and new attack types appear constantly.
Mistake
If I am a technical person, I do not need security awareness training because I already know about security.
Correct
Technical staff are often targeted specifically because they have elevated access. They need training on social engineering tactics just as much as non-technical staff.
This misconception comes from confusing technical knowledge of tools like firewalls with the psychological skills needed to spot manipulation. The two are different skill sets.
Mistake
A security awareness programme is the same thing as a security policy.
Correct
A security policy is a written document stating rules. A security awareness programme is the active, ongoing effort to teach and remind employees about those rules and the reasons behind them.
Beginners conflate the document with the activity. The exam tests the difference: the policy sets the standard, the programme ensures people know and follow it.
Mistake
Simulated phishing campaigns are unfair because they trick employees and get them in trouble.
Correct
Well-designed simulated phishing campaigns are educational tools. The goal is to identify who needs more training, not to punish. Employees should feel safe reporting their mistakes.
People bring their fear of being blamed at work into their understanding of security. The exam emphasises that a no-blame culture is essential for effective reporting.
Mistake
If a company has good technical controls like firewalls and antivirus, it does not need to spend money on security awareness training.
Correct
Technical controls can be bypassed by a single employee who clicks a malicious link or shares a password. Training is a necessary layer that protects the human element.
This mistake comes from an over-reliance on technology and a misunderstanding that people are a weak link that technology cannot fully protect.
Mistake
Security awareness training only matters for large organisations; small businesses do not need it.
Correct
Small businesses are actually targeted more often because attackers know they often have weaker defences, including less training. Every organisation needs it regardless of size.
Beginners think that only big companies have valuable data. In reality, a small business's customer list, bank details, and employee records are all valuable to criminals.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Security awareness is the ongoing state of being alert to security risks. Security training is the formal instruction that builds and maintains that awareness. Training is an activity; awareness is the outcome.
Yes, the topic is part of Domain 1.0 (Security Principles) and specifically objective 1.5. You will be tested on your understanding of social engineering types, due care, and the components of a security awareness programme.
Yes, organisations with comprehensive training programmes see significantly fewer successful social engineering attacks. Training turns employees from a weak link into a human firewall.
Best practice is initial training for all new hires, annual refresher training for everyone, and continuous awareness activities (emails, posters) throughout the year. Simulated phishing exercises are typically done quarterly.
The employee should immediately report it to the security team, not delete it or try to fix it themselves. A no-blame culture is essential so people report quickly without fear of punishment.
Phishing uses email, vishing (voice phishing) uses phone calls, and smishing (SMS phishing) uses text messages. All three are attempts to trick victims into revealing sensitive information or installing malware.
Yes, remote workers are often at higher risk because they may use personal devices and less secure home networks. Training must cover remote-specific risks like phishing on personal email and securing home Wi-Fi.
You've finished Security Awareness and Training. Continue through the CC study guide to build a complete picture of the exam.
Done with this chapter?