Security awareness trainingPublished benchmark

Training that changes behaviour.

A completion rate shows who attended. We match you to a program that shapes what your people do when a real lure lands, and measures it in one score.

Review your training programRead the benchmark

Free. No fit, no obligation.

The problem

Most programs fail before the platform is chosen.

In most Australian organisations, IT picks the tool on compliance criteria, rolls it out once and leaves it. About two in three platforms on the market can change behaviour. Only about one in thirteen programs do. The gap is in how the program runs.

So the decision in front of you is whether you're building a behaviour-change program at all. A program has an owner, is measured over time, and is run as organisational change for its first six months. A platform is only the tool.

1 in 13programs actually change behaviour, though around two in three platforms can.

Architecture

Three ways to teach, only one that sticks.

How a platform teaches matters more than how much content it holds.

  1. 01

    The library

    A huge catalogue you're left to curate. Most of it is never watched. Volume looks impressive in a demo, then turns into a queue nobody gets through.

  2. 02

    The exam

    Quiz first, train only the gaps. Efficient on paper, but it assumes people already have the foundations, so it tends to patch holes in a wall that was never built.

  3. 03

    The curriculum

    A sequenced pathway that builds the foundations in order, like a school. People with the basics can handle most lures, even ones they've never seen. It's the approach we recommend for most Australian teams.

Security awareness training

Completion is not competence.

A completion rate tells you people attended. It says nothing about how they'll act when a convincing lure lands. In Proofpoint's Australian data, 96% of people who took a risky action knew it was risky.

Measure behaviour under pressure instead, tracked over time as one score a board can act on. It moves as behaviour changes, so you can show whether your people are a smaller risk in 12 months.

What you get

What a real program gives you.

What a program earns you that a completion rate never will.

Behaviour that holds under pressure

People who report a real lure and pause on the unusual request, because the foundations were built in order, not because they happened to have seen that exact scam before.

What to look for

What can the top platforms do?

A content library, scheduled phishing simulations and completion reporting are the baseline every platform clears. These are the capabilities that separate a program that changes behaviour from one that only records attendance, and where genuine AI in this category earns the word rather than dressing up rule-based scheduling.

  • Adaptive, per-user simulations

    Difficulty and lure that calibrate to each person's real risk profile, not the same template randomised across the whole company.

  • A sequenced curriculum

    Foundations built in order for each learner, so training compounds rather than scattering across a catalogue nobody finishes.

  • One-click active reporting

    A report button in the inbox that turns every user into a live sensor, so a real lure is flagged in seconds rather than clicked.

  • A single behavioural risk score

    The one number that translates behaviour across simulations, reporting and training into something a board can act on and track over time.

  • Timely threat alerts

    Short, current briefings on the scams actually circulating in Australia right now, so training reflects this week's threat, not last year's.

  • Genuine per-user AI

    Content and difficulty selected dynamically from a real risk profile, which is what AI means here, not template randomisation or a rules-based schedule wearing the label.

Maturity

Where most programs sit today.

Security awareness maturity, tier by tier.

  1. Focused

    An annual training module and the occasional phishing test, reported by completion rate, run to satisfy an audit. It ticks a box and rarely changes behaviour. Many mid-market teams sit here.

    Typical features

    • An annual training module
    • The occasional phishing test
    • Reported by completion rate
    • Run to satisfy an audit

  2. Broad

    A sequenced curriculum, adaptive simulations and active reporting, run as an owned program with a behavioural risk score tracked over time.

    Typical features

    • A sequenced curriculum
    • Adaptive phishing simulations
    • A report button people use
    • An owned program
    • A behavioural risk score tracked over time

  3. Best fit if you’re being targeted

    Comprehensive

    Everything Broad does, plus per-person calibration and behaviour measured continuously and fed back into the business. The most room to adapt as lures change. Start here if a staff member has already handed over a login.

    Everything in Broad, plus

    • Training calibrated to each person
    • Behaviour measured continuously
    • Results fed back to the business
    • Culture that shows without prompting
    • Evidence auditors and insurers expect

Tekspace Research

We tested the training platforms.

We benchmarked the leading human-risk platforms against the same tests, including which ones calibrate to each user and which only look like they do. The ranking reflects what we measured.

Published benchmark

Security Awareness Training

Is your training changing behaviour, or just recording completion?

Turns staff from the easiest way in into people who spot the lure and report it.

What we found

Training built for compliance widens the skills gap. The platforms that work aim at sustained behaviour change and calibrate to each person.

Vendors assessed

  • Adaptive Security
  • Barracuda
  • Boxphish
  • CyberHoot
  • Hacker Rangers
  • Hoxhunt
  • Huntress
  • ID Agent
  • Immersive Labs
  • Infosec IQ
  • KnowBe4
  • MetaCompliance
  • Mimecast
  • Ninjio
  • Phished
  • Proofpoint
  • Riot
  • SANS Institute
  • SoSafe
  • usecure

What we tested

  • Email, SMS, voice and QR simulations
  • Report button in the inbox
  • A risk score per person

Same tests on every product. The full scores are in the benchmark.

Read the benchmark

The Tekspace Fit Method

How we’d help you choose.

Five steps from the problem you have to the product that fits, each leaving you with something you keep.

  1. 01

    Understand

    For security awareness training

    Agree the behaviour you want to change and the one number you’ll report on.

    What you get

    Problem brief. The agreed problem and what success looks like.

  2. 02

    Map

    For security awareness training

    Your current training, phishing results, culture, and who owns the program.

    What you get

    Environment map. Your tools, identity, users and constraints.

  3. 03

    Narrow

    For security awareness training

    Platforms that teach in sequence and report one behaviour score, the two things a real program needs.

    What you get

    Shortlist with reasons. Why each option made it, and why the rest did not.

  4. 04

    Prove

    For security awareness training

    A pilot group shows reporting and risk moving before you roll it out.

    What you get

    Proof-of-value results. How each option did against your problem.

  5. 05

    Enable

    For security awareness training

    Launch it as a program, with an owner and a six-month plan.

    What you get

    Handover plan. Deployment, training and who owns what.

See our methodology

Questions we hear most.

Even where we have a product we like, we’ll recommend something else if your context calls for it.

  • No consulting fee
  • If nothing fits, we say so
  • Vendor-independent
  • Operating since 2006