Why companies run it
Most successful attacks start with a person, not a machine: an email opened, a password reused, a file shared with the wrong recipient. Technical controls catch a lot, but the moment a staff member clicks, the attacker is inside. Awareness training is the practice that gives every employee a small, reliable set of habits: stop and check before acting, verify through another channel, and report early.
It also builds the reporting habit. A company where people report a suspicious email in minutes, without fear of blame, finds out about incidents early — and early reports are usually the cheapest to handle.
What it usually covers
- Email phishing and spear phishing — fake messages that ask for a click, a login or a payment
- Smishing and vishing — the same tricks over SMS and phone calls, including AI voice cloning
- Passwords and authentication — passphrases, password managers, MFA, passkeys, one-time codes
- Data protection — classification, need-to-know, sharing safely, privacy settings
- Devices and networks — updates, USB media, public Wi-Fi, home networks, lost phones
- The workplace itself — clear desk, visitors and tailgating, insiders, working remotely
A full programme for a Gulf company typically runs to around 40 short topics. Our course library covers exactly that spread: 40 animated story courses in English and Arabic, each 2 to 3.5 minutes with a scenario quiz.
Formats: slides, videos, simulations
Slide-based e-learning is the cheapest to make and the easiest to click through without learning. Video-based courses hold attention better when they tell a story: one character, one mistake, one lesson. Simulations (fake phishing tests) measure behaviour directly but work best alongside training, not instead of it.
| Format | Strength |
|---|---|
| Story video + quiz | Remembered like a story; fits a team meeting |
| Slide e-learning | Cheap, fast to update |
| Phishing simulations | Measures real behaviour |
How to run a programme, in six steps
- Start with the threats your teams actually meet — for most offices that is phishing, payment fraud and passwords
- Pick a length people will finish: 2–5 minutes per course, one or two courses a month
- Make the report method impossible to miss: it should be on the end card of every course and on the intranet
- Measure with the quiz that follows each course, not with attendance
- Repeat: one-off annual training fades; short repeats stick
- Review after real incidents: the topic of your last incident goes to the top of next quarter’s list
Common mistakes
- Compliance-shaped training: long, generic, watched on mute while the tab sits in the background
- Scenarios from another world: a US bank story teaches a Gulf office very little
- One language only: a multilingual workforce needs the training in the languages it thinks in
- No follow-up: training that ends without a quiz or a report method rarely changes a habit
- Blaming people who report mistakes — the fastest way to make sure the next mistake stays unreported
How to tell if it is working
- Quiz results over time, topic by topic (our quizzes use a bank of 12–15 questions per course, 10 shown, pass mark 80)
- Reporting rates: more reports, and faster reports, are a good sign
- Click rates on simulations, if you run them
- Ask people: a one-question survey after each course (“name one thing you will do differently”)
What good training looks like in the Gulf
A workforce in the UAE or Saudi Arabia speaks many languages, meets scams built around Eid offers and delivery fees, and includes teams — from finance to plant operations — with very different risks. Training made for that reality does three things: it works in English and Arabic (and the other languages your teams speak), it uses locally believable scenarios, and it covers both office and field roles. See our guide to training for teams who do not speak English, and the Arabic training guide.