We already run phishing tests and training. Isn't that enough?

Only if it's changing behaviour, and a completion rate can't tell you that. Running simulations and pushing modules is the easy part every platform does. The value is a sequenced program that moves a measured behaviour over time.

Our people already know not to click. Why train them?

Knowing is not the problem. In Proofpoint's Australian data, 96% of people who took a risky action already knew it was risky and did it anyway. Awareness on its own does not close that gap; a program that builds and measures behaviour under real pressure is what does.

Won't staff feel policed or resent being tested?

That risk is real, and it is the fastest way to kill a program. A failed test that produces shame produces disengagement, and disengagement defeats the whole effort. Done properly the program protects people rather than catching them out, which is why reporting and engagement go up rather than down.

Is "human risk management" something different?

Mostly it's the same category under a newer name, and the rename is the field admitting the old awareness model didn't work. The question is whether your program meets the new standard of measured behaviour change, or the old one of completion rates and an annual module.

Does this count toward the Essential Eight?

No. Security awareness training sits outside the eight. Its compliance hooks are ISO 27001, the awareness questions in cyber-insurance questionnaires, and the Privacy Act and OAIC obligations that treat the human element as part of reasonable security.

Security awareness trainingPublished benchmark

Training that changes behaviour.

We match you to a program that changes how people respond to lures, measured in one score.

Review your training program Read the benchmark

Free. No fit, no obligation.

The problem

Most programs fail before the platform is chosen.

In most Australian organisations, IT picks the tool on compliance criteria, rolls it out once and leaves it. About two in three platforms on the market can change behaviour. Only about one in thirteen programs do. The gap is in how the program runs.

So the decision in front of you is whether you're building a behaviour-change program at all. A program has an owner, is measured over time, and is run as organisational change for its first six months. A platform is only the tool.

1 in 13programs actually change behaviour, though around two in three platforms can.

Architecture

Three ways to teach, only one that sticks.

How a platform teaches matters more than how much content it holds.

01
The library
A huge catalogue you’re left to curate, most of it never watched. Impressive in a demo, then a queue nobody gets through.
02
The exam
Quiz first, train only the gaps. It assumes the foundations are there, so it tends to patch holes in a wall never built.
03
The curriculum
A sequenced pathway that builds foundations in order, so people can handle most lures, even new ones. We recommend it for most Australian teams.

Security awareness training

Completion is not competence.

A completion rate tells you people attended. It says nothing about how they'll act when a convincing lure lands. In Proofpoint's Australian data, 96% of people who took a risky action knew it was risky.

Measure behaviour under pressure instead, tracked over time as one score a board can act on. It moves as behaviour changes, so you can show whether your people are a smaller risk in 12 months.

What you get

What a real program gives you.

What a program earns you that a completion rate never will.

Behaviour that holds under pressure

People who report a real lure and pause on the unusual request, because the foundations were built in order, not because they happened to have seen that exact scam before.

What to look for

What can the top platforms do?

These capabilities separate behaviour change from recorded attendance, and show where the AI is genuine.

Adaptive, per-user simulations
Difficulty and lure that calibrate to each person's real risk profile, not the same template randomised across the whole company.
A sequenced curriculum
Foundations built in order for each learner, so training compounds rather than scattering across a catalogue nobody finishes.
One-click active reporting
A report button in the inbox that turns every user into a live sensor, so a real lure is flagged in seconds rather than clicked.
A single behavioural risk score
The one number that translates behaviour across simulations, reporting and training into something a board can act on and track over time.
Timely threat alerts
Short, current briefings on the scams actually circulating in Australia right now, so training reflects this week's threat, not last year's.
Genuine per-user AI
Content and difficulty selected dynamically from a real risk profile, which is what AI means here, not template randomisation or a rules-based schedule wearing the label.

Maturity

Where most programs sit today.

Security awareness maturity, tier by tier.

Focused
An annual module and the occasional phishing test, reported by completion rate to satisfy an audit. Many mid-market teams sit here.
Typical features
- An annual training module
- The occasional phishing test
- Reported by completion rate
- Run to satisfy an audit
Broad
A sequenced curriculum, adaptive simulations and active reporting, run as an owned program with a behavioural risk score tracked over time.
Typical features
- A sequenced curriculum
- Adaptive phishing simulations
- A report button people use
- An owned program
- A behavioural risk score tracked over time
Behaviour change begins here
Comprehensive
Everything Broad does, plus per-person calibration and behaviour measured continuously and fed back to the business. Start here if staff have already handed over a login.
Everything in Broad, plus
- Training calibrated to each person
- Behaviour measured continuously
- Results fed back to the business
- Culture that shows without prompting
- Evidence auditors and insurers expect