The best security awareness courses are short, role-aware and measured by what employees do afterward, not by who clicked "complete." A 15-minute baseline module is a fine start for every employee. It is not a program. This guide explains the types of courses, how long they run, what they cost, what a certificate proves, and how to build a curriculum that your customers' security reviewers will accept as evidence.
We wrote it for CISOs, GRC and compliance leads, and the sales and solution engineering leaders who end up answering the questionnaire question, "Do you train your staff on security?" Please feel free to take what fits your organization and leave the rest.
TL;DR
- Treat a course as one component of a lifecycle program. NIST SP 800-50 Rev. 1, published September 12, 2024, frames learning around behavior change, culture, metrics and evaluation.
- Separate baseline awareness for everyone from role-based training for developers, administrators, executives and sales teams.
- Measure reporting behavior and simulation trends, not attendance alone.
- Pair training with technical controls. CISA says even well-trained employees can be tricked by phishing.
- Keep the evidence (content, completion, results) organized, because buyers will ask for it in security questionnaires.
Table of Contents
- What security awareness courses actually are
- The four types of courses most programs use
- How long should a course take?
- What security awareness training costs
- Do you need a certificate?
- Compliance: what frameworks actually expect
- Building a program, step by step
- Training is one layer, not the whole defense
- Our perspective: training is evidence you will be asked for
- Where Skypher fits
- How to choose a course: a short checklist
- FAQ
- Sources
What security awareness courses actually are
A security awareness course teaches employees to recognize and handle the threats they meet in daily work: phishing, social engineering, weak passwords, careless data handling, unmanaged devices and physical access. The format ranges from a 15-minute video to a multi-day instructor-led class.
NIST makes a useful distinction that most vendor pages blur. Its awareness, training and education model separates three things:
- Awareness builds general understanding for everyone.
- Training develops capabilities tied to a specific job role.
- Education supports deeper professional expertise.
When someone searches for security awareness courses, they usually need the first, are often sold the second, and rarely need the third. Knowing which one you are buying keeps you from paying for a role-based program when you need a baseline, or the reverse.
The four types of courses most programs use
People often ask for "the four types of security training." There is no single mandated taxonomy, so define yours in your program documentation and map each type to a risk, a role and a control. The grouping below is the one we see most often in practice, and it lines up with NIST's awareness, training and education distinction.
| Type | Who takes it | Typical content | What it proves |
|---|---|---|---|
| Baseline awareness | Every employee and contractor | Phishing, passwords, MFA, data handling, reporting | General understanding, at onboarding and each year |
| Role-based training | Developers, admins, finance, executives, sales | Secure coding, privileged access, wire-fraud, customer data handling | Capability tied to the person's actual risk |
| Threat-specific reinforcement | High-exposure groups or everyone | Phishing simulations, short refreshers after incidents | Whether behavior changes over time |
| Advanced education | Security and GRC staff | Professional courses, certifications | Depth of expertise on the team |
For a B2B software company, the second row matters most. A developer and a solution engineer face different risks, and one identical video for both serves neither. We cover the developer side in our guide to security coding training for secure development, and the finance-sector view in seven essential security awareness trainings for fintech leaders.
How long should a course take?
Shorter than most people expect, and split into pieces. Public examples show the range:
- Amazon's cybersecurity awareness course runs about 15 minutes and covers phishing, social engineering, data privacy, MFA, secure communication, data classification and physical security. The page itself notes there is no assessment and recommends additional training, reminders and quizzes.
- FEMA's IS-906 Workplace Security Awareness is a one-hour online course with no prerequisites and a final exam. It is U.S. government training, so do not read its length as a universal standard.
What do these two tell you? A 15-minute module works for baseline awareness, but it is not a complete role-based program. An hour with an exam creates a record of understanding, though it still says little about behavior six months later.
We suggest a modular model: a short baseline at onboarding, a short annual refresher, and a handful of micro-lessons assigned by threat and by role. Employees finish a ten-minute lesson on password managers. They skip a ninety-minute annual marathon, or click through it.
What security awareness training costs
There is no single price. Models differ: self-paced modules, per-user subscriptions, managed phishing programs and instructor-led classes are all priced differently. CISA's NICCS listing for a program-design course says plainly that cost and registration details come from the training provider, and that no universal price exists.
When you compare quotes, add up the total cost of delivery:
- Content licensing and number of seats.
- Administration time: enrolling new hires, chasing completions, producing reports.
- Phishing simulation and reporting tools, if not bundled.
- Content localization and customization for your roles.
- The cost of evidence: how easily you can export results for an auditor or a customer.
The last item is the one buyers forget. A course that cannot produce a clean report costs your GRC team hours every time a questionnaire arrives.
There are also free options. CISA describes a Phishing Campaign Assessment as a free six-week service for eligible public and private organizations, which is worth checking if you have no simulation tooling yet.
Do you need a certificate?
It depends on who is asking. Many employees receive a completion certificate at the end of a course, and it is useful as a record. But a certificate shows attendance. It does not show that anyone now reports suspicious emails faster.
The NICCS course description puts the problem well: many programs measure attendance and stop there. Its own program-design course focuses on role-based training, phishing simulations and metrics that demonstrate behavior change.
Our practical view:
- Keep completion certificates for the audit file.
- Do not present them as proof of effectiveness.
- If a customer or regulator asks for a certificate, give them the certificate plus the completion rate and simulation trend.
If you are weighing certificates for individuals, we wrote a separate walkthrough: how to earn a security awareness training certificate.
Compliance: what frameworks actually expect
Most frameworks ask for training that is documented, current and repeated. One concrete example: PCI DSS 4.0.1 requirement 12.6.2, which requires the awareness program to be reviewed and updated at least every 12 months and became mandatory on March 31, 2025. That applies to organizations in scope for PCI DSS, not to everyone.
Other frameworks you may be measured against, such as SOC 2 or ISO 27001, expect similar evidence in their own words. We go through those expectations in our guides on cybersecurity compliance for tech and finance teams and information security standards. Check the exact control wording with your auditor before you finalize a curriculum.
Building a program, step by step
NIST's 2024 revision recommends a lifecycle approach to the learning program, with metrics, evaluation and regular updates as risks change. It also supersedes the 2003 version of SP 800-50 and SP 800-16 from 1998. Here is how we would translate that into a working plan.
1. Start from your risks
List the incidents and near-misses you have actually had. Business email compromise, credential phishing, mishandled customer data and shadow tools are common in software companies. Each one points to a lesson.
2. Segment your audiences
At a minimum, create four groups: all staff, engineering, privileged administrators, and customer-facing teams (sales, support, solution engineers). Add executives and finance if you have not yet.
3. Choose or build content
Use a short baseline for all staff. Add role modules where the risk is specific. For sales teams, our piece on cybersecurity tips for sales directors shows what that looks like in practice.
4. Make reporting easy
CISA notes that even a well-trained employee might be tricked, so the goal is not perfection. It is fast reporting. One button in the mail client, and a thank-you to the person who used it.
5. Use simulations constructively
CISA's anti-phishing program model describes a feedback loop: awareness and training, simulated attacks, analysis of results, and modified training. Use simulations to find where lessons are failing. Do not use them to shame individuals, because people who fear punishment stop reporting.
6. Measure, then adjust
Track these, in this order of importance:
- Reporting rate of real and simulated phishing.
- Time from delivery to first report.
- Repeat-failure trends by group, not by name.
- Completion rates and overdue counts.
- Incidents attributed to human error, quarter over quarter.
We look at one version of this approach in how security awareness programs cut human risk, and give a wider program checklist in our staff security training program guide.
Training is one layer, not the whole defense
CISA's guidance is explicit that workforce training should be combined with technical precautions: secure email gateways, web-browsing protections, hardened endpoints and endpoint protection. Its guide frames it as training plus technical precautions leading to fewer successful phishing attempts.
That has a budget consequence. If you are choosing between a premium course library and fixing weak email filtering or missing MFA, fix the controls first. A broader checklist is in our cybersecurity best practices for enterprises and our data and cyber security guide for tech and finance teams.
Our perspective: training is evidence you will be asked for
At Skypher we spend our days inside security questionnaires, so we see your training program from the other side of the table: the reviewer's. Almost every questionnaire and due diligence request includes questions about employee training. How often is it delivered? Is it role-based? Is phishing simulated? How do you track completion? Do contractors take it?
Teams that run good programs still lose days to these questions, because the answers live in an LMS export, a policy document and one person's memory. Three habits make a difference:
- Write the program down once. A single, current description of audiences, frequency, content and metrics, stored in your knowledge base, is the source for every future answer.
- Keep the numbers fresh. A completion rate from two years ago is worse than no number, because it signals that nobody is looking.
- Align the course with the claim. If your answers say "role-based," the course catalog should show it.
We built our platform around the idea that approved answers should be reused, versioned and traceable to their source documents, so that a training answer given in January matches the one given in June. The course you choose matters less than whether you can describe it accurately, quickly and consistently.
— Gaspard
Where Skypher fits
Skypher does not sell awareness courses. We help you prove the program you already run. Our AI-powered Questionnaire Automation Tool answers security questionnaires from your own documents, with a confidence score on each answer, so your training policy, completion reports and program description become reusable answers. Our Trust Center lets you publish the security posture that buyers want to see up front, which can reduce how many of those questions arrive in the first place. If you would like to see it with your own questionnaire, please reach out and we will happily walk you through it.
How to choose a course: a short checklist
When you evaluate a library or provider, ask for the following and compare answers side by side:
- Module length: are lessons short enough to assign by topic?
- Role coverage: can you assign different paths to developers, admins, executives and customer-facing teams?
- Assessment: is there a quiz or scenario check, or only a video?
- Simulation and reporting: does it include phishing tests, and a way for staff to report them?
- Reporting and export: can you produce completion and trend reports in a format an auditor accepts?
- Update cadence: how often is content refreshed as threats change?
- Accessibility and language: does it work for your whole workforce?
- Total cost: seats, administration time, add-ons and renewal terms.
A vendor that answers the first five with specifics is usually further along than one that leads with a certificate.
FAQ
How long is security awareness training?
It ranges from about 15 minutes for a baseline module, as in Amazon's course, to an hour for FEMA's IS-906, to multi-day instructor-led classes. For most companies, a short onboarding module plus brief refreshers by topic works better than one long session.
How much does security awareness training cost?
Prices depend on the model: self-paced modules, per-seat subscriptions, managed phishing programs and instructor-led classes all differ, and no universal price exists. Request quotes and compare the total cost, including administration time and reporting, not just the license.
What is security awareness training?
It is education that helps employees recognize and respond to threats such as phishing, social engineering and data mishandling. NIST treats awareness as the general-understanding layer, distinct from role-based training and professional education.
What are the four types of security training?
There is no official list of four. A common structure is baseline awareness, role-based training, threat-specific reinforcement such as phishing simulations, and advanced education. Document your own categories and map each one to a risk and a role.
Does a certificate prove my team is secure?
No. A certificate records that someone finished a course. To show that behavior has changed, add reporting rates and simulation trends, as CISA's feedback-loop model suggests.
Sources
- NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program
- NIST, Awareness, Training, Education (ATE)
- CISA, Counter-Phishing Recommendations for Non-Federal Organizations
- CISA, Anti-Phishing Training Program Support
- CISA
- NICCS, Security Awareness Program Design & Delivery
- Amazon, Cybersecurity Awareness training
- FEMA, IS-906 Workplace Security Awareness
- SecurityMetrics, PCI security awareness training requirements