Social engineering is cited as one of the primary threat vectors (see for example at: https://gallery.technet.microsoft.com/Fixing-the-1-Problem-in-2e58ac4a). Employee awareness training is also cited as one of the best means to mitigate this threat (see the same paper linked above).

My company has a 20 minute computer-based training module on social engineering awareness and prevention that is delivered once per year. But I am a computer security guy and I have trouble remembering what it said, so I question its effectiveness.

Is there any industry awareness or consensus on what constitutes an effective social engineering awareness program? If so, what are the features of such a program?

3 Answers 3


Note that I am writing a book on this very topic.

Social Engineering is all about getting people to do something. To combat that, you need to train your users to do something else. A 20 minute video once a year is not an effective means to affect someone's behaviour.

Ongoing, recurring training, embedded in the user's normal work routines, is the most effective method to change behaviours. Add to that, simulated scenarios (mock phishing, etc.) so that users have a chance to practice their skills in a safe way, can cement the new behaviours in the long term. There is a lot of research and study on the effectiveness of this approach.

Security Awareness is not a "fire and forget" exercise. It requires a "slow drip" of knowledge, training, and practice that is supported by an approachable, and even empathetic, security team.

In my book, I liken the problem to trying to get your entire workforce to loose 5 pounds. Once you start to think like that, you start to see that the problem is not "what's the best video to show?" but rather, "how to help each person every day?"

  • As you are writing a book on the subject, is it safe to presume that you have not found a generally available text or methods on how best to make the staff aware? BTW - do you have an anticipated publish date?
    – Stone True
    Commented Dec 2, 2015 at 15:53
  • There are tons of studies on the topic, but the audience of the studies are education professionals. Plus, a lot of the studies are sponsored by Security Awareness vendors, so you might not accept their impartiality.
    – schroeder
    Commented Dec 2, 2015 at 15:57
  • 1
    Oh, and I'm hoping to publish this month!
    – schroeder
    Commented Dec 2, 2015 at 16:14
  • 1
    @schroeder I think I know what I'm getting myself for Christmas :)
    – user72066
    Commented Dec 2, 2015 at 20:48

The primary issue with security awareness is that it's largely about the "low hanging fruit". In my experience, social engineering campaigns are able to less sophisticated the broader they are. If you target the workforce of an entire large company, you only need something that looks semi-coherent for some caffeine-starved desk-worker to absentmindedly click the link/open the document.

As you target more specific groups or individuals, additional research, preparation and care is needed to achieve the same level of success (admittedly, you can do a tailored campaign to a larger audience and have a higher uptake, but tailoring has the inherent issue of becoming more specific to the group). The more sophisticated attacks are less distinguishable from the usual day-to-day activity of the workers (you can't manually verify each and every email you receive).

With all of these attacks, an incredibly small rate of return is all that's needed for it to be viewed as successful. Your security awareness training needs to become second nature for not just your hardened tech-heads, but the possibly more mundane admin staff, and the busy execs. Everyone involved needs to have that immediate second-thought whenever a possibly suspicious email comes through. It needs to be tailored to how your organisation is structured, how you operate and how you appear to the outside.

A one-size-doesn't-really-fit-anybody set of training materials is more likely to be dismissed as generic and "well, yes, but that doesn't really apply to me does it?". I've looked for something amounting to a standard template, but haven't found much of anything above the bullet points of what should be contained.


As far as general guidelines on the awareness on how to be at bay from social engineering attacks are included in the latest version of industry recognised certifications such as CISSP and CEH.

Online training courses from sites such as Udemy and plurasight also have sufficient and effective materials.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .