What We Do
How We Do
Get Started


Ep. 7: Security Awareness Training and Phishing Testing

BY eSentire

December 21, 2021 | 4 MINS READ

Cyber Risk

Cybersecurity Strategy

Threat Intelligence

Want to learn more on how to achieve Cyber Resilience?


Cybersecurity is not an IT problem to solve—it's a business risk to manage. In the Managing Cyber Risk podcast series, Mark Sangster, Vice President and Industry Security Strategist with eSentire, and Cybercrime Magazine’s Hillarie McClure lead conversations with cybersecurity experts, using the dollars-and-cents language of the C-suite to expose the issues, challenges and pitfalls which are often obscured by ones and zeroes.

Want to listen to the full episode instead? Click here.

Most of the devastating cyberattacks begin with a phishing email that tricks a user into aiding the threat actor. To increase resilience against this tactic, organizations turn to security awareness training and phishing testing. Often, these testing programs are combined into Phishing and Security Awareness Training (PSAT), typically structured as a set of lessons, tests, and simulations designed to teach employees how to avoid falling prey to phishing attempts and other cybersecurity threats.

PSAT programs recognize that behind all the technology that is often at the center of cybersecurity discussions, there are people—and those people can be manipulated and tricked by clever cybercriminals. But PSAT programs are not created equal, nor are they as simple as many people think, which means many organizations are not getting the results they want (or need).

As Mark Sangster, our VP Industry Security Strategy, put it in a recent Managing Cyber Risk podcast, “PSAT is something every company is likely doing [so the question becomes,] are they doing what’s necessary and moving the needle?”

Moving beyond a compliance mindset

Companies in highly regulated industries (e.g., healthcare and finance) or those that have a large number of professionals licensed by a governing body (e.g., doctors, accountants, engineers) are more likely to have a formal PSAT program as part of their compliance activities.

However, PSAT should be about business outcomes—about reducing risk and the consequences associated with cybersecurity events—and a compliance mindset can create a false sense of security.

Moreover, a risk-based approach to cybersecurity allows business leaders to direct investments in the most effective way with the goal of reducing risk over time. In a world of scarce resources, this approach leads to superior cybersecurity outcomes when compared to maturity-based or compliance-based approaches.

In Mark’s words, “When it comes to a successful program, it’s not about an hour of class time a year or making up a couple of fake phishing emails. You really need an integrated approach that’s manageable and that provides information you can feed up the chain to the C-suite or your board to demonstrate that you are delivering value—that you are reducing risk.”

Why do so many PSAT programs fail to achieve the desired outcomes?

Perhaps the biggest reason why many PSAT initiatives don’t deliver the desired results is because they start with an underlying assumption that users are irresponsible or stupid, and this fundamentally flawed premise shapes ‘training’ that is little more than definitions, jokes, and generic examples that are easy to spot. All that such training achieves is reiterating the stereotype that victims are at fault.

While it’s all-too-common to scapegoat employees for their mistakes, or to act like threats are self-evidently obvious, the reality is that cybercriminals are extremely skilled at disguising their lures. So, the first step in conducting effective Phishing and Security Awareness Training is to recognize and accept that:

Look at your employees as an important part of the solution to a problem that has claimed many sophisticated victims and treat your team with the respect that is warranted of such a crucial role. Then, make sure your team is aware of the six common causes of failure that have undermined many PSAT initiatives and ensure you don’t fall victim to them.

What makes a PSAT program effective?

It’s critical that PSAT programs leverage realistic threat scenarios that foster context-relevant (e.g., tailored to your industry and risks) security awareness, rather than using commoditized and easy-to-spot templates that are increasingly relics of the past.

Consider the structure of the program and look for programs that:

Effective PSAT programs deconstruct the tools, techniques, and procedures (TTPs) that cybercriminals employ using relevant examples.

Mark speaks with many business leaders, and he often must remind them that PSAT is more important and more involved than they initially perceive it to be.

“This isn’t a simple thing to do. A lot of people in the security world think it is: buy a tool, choose from some templates, do a presentation once a year. It’s far more than that—it’s about creating a comprehensive program and demonstrating that you’re protecting the business.”

Remember, PSAT is about real business outcomes, not simply checking a box.

Learn more about implementing your own PSAT program

Listen to the full Security Awareness Training and Phishing Testing episode of the Managing Cyber Risk podcast series as Mark Sangster and Hillarie McClure discuss cybersecurity awareness training and phishing testing, how these help improve business resiliency by reducing the risks associated with human-targeted attacks, commonly held misconceptions about these important programs, and much more.


eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire