Security+ Security Awareness: Phishing Training, Reporting, and Human Risk

Introduction

This lesson completes Domain 5, Security Program Management and Oversight (20% of SY0-701), by covering objective 5.6, implementing security awareness practices. Security+ security awareness connects practical user guidance, accessible reporting, and supportive organizational controls. Attackers exploit trusted workflows as well as technical flaws. A learning program helps staff recognize unusual requests and report them early, while the organization fixes process and technology weaknesses that make mistakes costly.

The exam does not ask you to design a psychology course. It asks whether you can recognize phishing and related behaviors, choose appropriate training and simulation methods, identify anomalous behavior, define reporting paths, and measure whether the program works. After this lesson you should be able to read a short scenario about an employee, a message, or a training campaign and pick the best response.

Learning objectives

After this lesson you will be able to:

• Recognize phishing, vishing, smishing, business email compromise, and other social engineering signs.
• Explain phishing campaigns and simulations and how to run them responsibly.
• Describe user guidance topics: policy and handbooks, situational awareness, insider threat, password management, removable media, social engineering, operational security, hybrid and remote work, and safe use of AI tools.
• Identify risky, unexpected, and unintentional anomalous behavior.
• Describe reporting and monitoring of awareness activity and how to report an incident.
• Measure awareness with initial and recurring training, development, and effectiveness metrics.
• Explain how a positive security culture reduces risk.

1. Why awareness matters

Workflows, tools, and human decisions interact to create exposure. Examples include:

• Clicking a malicious link or opening a weaponized attachment.
• Entering credentials into a fake login page.
• Sharing passwords or reusing them across sites.
• Sending sensitive data to the wrong recipient.
• Misconfiguring a cloud storage permission.
• Falling for a phone call that impersonates the help desk or an executive.
• Letting an unknown person follow them through a secured door (tailgating).

Awareness is a preventive and detective administrative control, as you saw in the controls lesson. Training helps people avoid mistakes; reporting helps the security team detect an attack that got past technology. Awareness never replaces technical controls such as email filtering, multifactor authentication, and endpoint protection. It adds a layer to a defense in depth strategy.

Awareness, training, and education

These three words are related but not identical. Awareness is short, frequent reminders that keep security in mind (posters, emails, short videos). Training teaches specific skills for a role (how to spot phishing, how developers write secure code). Education develops deeper conceptual understanding over a longer period and can support many roles, including security professionals. A good program uses all three: everyone gets awareness, users get role-based training, and security staff get education.

2. Recognizing phishing and related attacks

Phishing is a fraudulent message designed to trick the recipient into revealing credentials, running malware, or performing an unwanted action. The exam lists several variants.

Warning signs users should learn

• Urgency or threats: "Your account will be closed in one hour."
• Authority pressure: a message that seems to come from the CEO demanding a quick payment.
• Mismatched sender or link: the display name says "IT Support" but the address is a free email account; hovering over a link reveals a different domain.
• Unexpected attachments or requests to enable macros.
• Requests that bypass process: changing a vendor's bank account over email without callback verification.
• Generic greetings and awkward language, although generative AI is making polished phishing more common, so a clean message is no longer proof of safety.
• Requests for credentials, MFA codes, or gift cards.

Other social engineering behaviors

The social engineering lesson covered the principles attackers exploit (authority, urgency, scarcity, familiarity, consensus, intimidation, trust). Awareness training applies them to physical settings too: tailgating and piggybacking at doors, shoulder surfing, dumpster diving, USB drops in the car park, and impersonation of delivery or maintenance staff. The defense is a policy that anyone entering must badge in, visitors are escorted, and staff follow the approved visitor/verification process and contact security when needed, rather than improvising a confrontation.

Review threat actors, social engineering, and attack vectors to connect warning signs to attacker goals without assuming every unusual message is malicious.

3. Phishing campaigns and simulations

A phishing simulation (campaign) sends safe, realistic test messages to employees to measure and improve their response. The purpose is learning, not punishment.

A responsible campaign includes:

1. Authorization: management and HR approve the program, and the policy states that simulations occur.
2. Baseline: establish a starting measure with an authorized, appropriately designed exercise. Do not withhold essential onboarding guidance just to obtain an untrained comparison group.
3. Varied difficulty: obvious messages for new hires, targeted ones for finance or executives, and seasonal themes such as benefits enrolment or tax forms.
4. Immediate feedback: users who click see a short "teachable moment" page explaining the clues they missed.
5. Reporting button: a one-click way to report suspicious email, ideally in the mail client.
6. Metrics: validated click events, simulated submission events, report quality/rate, and time to report. Use safe test pages and dummy data; do not collect real passwords, MFA codes, or other authentication secrets.
7. Follow-up: extra training for repeat clickers, delivered supportively.
8. Recurring cadence: select a risk-based schedule with refreshers after relevant changes. Monthly or quarterly campaigns are examples, not universal requirements.

Avoid tactics that damage trust, such as simulations promising a fake bonus or using a real crisis. A fear-based culture makes employees hide mistakes, which is worse for security.

Example 1: finance team simulation

A 900-person logistics company runs its first campaign. Overall, 22% of delivered recipients generate validated click events and 9% trigger the safe test page’s submission event without real credentials being retained. The finance team’s click rate is 35%. Only 6% of all recipients report the message. The security team trains finance staff on invoice-fraud and BEC patterns, adds a "Report phishing" button, and re-tests three months later. The click rate falls to 11% and the report rate rises to 41%. Reporting provides opportunities for earlier triage and scoped message quarantine. Interpret the improvement alongside message difficulty, staff roles, delivery filters, and reporting accuracy; these example percentages alone do not prove that training caused the change.

4. User guidance and training topics

Objective 5.6 lists the content of good user guidance. Each topic should be tied to practical behaviors and policy.

Role-based training

Different people need different content. Executives need whaling and BEC awareness. Finance needs payment verification. Developers need secure coding. IT administrators need privileged access practices. Customer service needs identity verification and vishing awareness. Role-based training is more efficient and more memorable than one generic course.

Initial and recurring training

New employees complete initial training at onboarding, before they receive broad access. Recurring training follows (annual refreshers, monthly micro-lessons, and training after an incident or policy change) because skills fade and threats change. Training delivery can include instructor-led classes, e-learning, short videos, gamified exercises, newsletters, posters, and lunch-and-learn sessions.

Pair user guidance with MFA, identity lifecycle, and privileged access controls so protection does not depend on vigilance alone.

5. Recognizing anomalous behavior

Awareness extends to recognizing behaviors that suggest an attack or a policy problem. The exam groups them into three types.

Risky behavior is addressed by policy, coaching, and enabling a safer alternative (offer an approved file-sharing tool). Unexpected behavior is investigated by monitoring and the security team. Unintentional behavior is addressed with training, technical guardrails such as data loss prevention, and a no-blame reporting culture.

Technical support for behavior monitoring

People are the first sensors, but tools help too:

• User and entity behavior analytics (UEBA) establishes a baseline of normal activity and flags deviations.
• SIEM correlation combines log events such as impossible travel and repeated failed logins.
• Data loss prevention (DLP) detects sensitive data leaving through email or uploads.
• Email security gateways quarantine suspicious messages and rewrite links.
• Endpoint detection and response (EDR) reports suspicious processes.

Behavior monitoring requires an authorized purpose, appropriate legal basis, transparency, proportionality, access restrictions, and retention controls under the applicable rules. An acceptable-use acknowledgement alone does not make every form of surveillance lawful. Treat unusual activity as a lead to assess, not an accusation.

6. Reporting and monitoring

Awareness only helps if people know how and where to report and feel safe doing so.

Reporting channels

• A one-click report phishing button in the email client.
• A dedicated security mailbox or help desk number, listed on the intranet and in the onboarding pack.
• An approved confidential or anonymous channel for insider-risk concerns, with the organization’s applicable whistleblowing and non-retaliation protections. Requirements vary by jurisdiction and scope.
• A clear incident reporting procedure: report immediately, do not forward suspicious files to colleagues, do not delete the evidence, and note the time and what you did.

What a good user report contains

When an employee clicks a link they should not have, the best behavior is: disconnect from the network if instructed (or at least stop interacting), report right away using the approved channel, preserving the message and explaining the type of data entered without sending the password or MFA code itself. Follow responders’ instructions for reset from a trusted device, session containment, and evidence handling. Speed matters more than perfection. A user who reports within minutes gives responders time to contain credential theft; one who hides it for days gives attackers time to move laterally.

No-blame culture

If employees fear punishment, they stay silent. A positive reporting culture thanks reporters, explains outcomes, and uses repeated mistakes as an opportunity for support rather than public shaming. Apply HR and disciplinary policies fairly and consistently; avoid public shaming or a process that discourages prompt reports of honest mistakes.

Monitoring the program

The security team tracks both leading and lagging indicators.

A strong program watches trends rather than a single number. A low click rate might only mean the simulation was easy. Rising timely, useful reports can indicate better reporting behavior, but compare like-for-like audiences and campaign difficulty. Define denominators, deduplicate repeat reports, and exclude confirmed automated scanner clicks before drawing conclusions. Completion proves participation, not proficiency.

Connect reports to the incident response and evidence-preservation workflow so users know what happens after they ask for help.

7. Building a security culture

Security culture is the shared set of attitudes and habits regarding security. Technical controls and training are weaker if managers ignore the rules. Culture grows when:

• Executives follow the same rules and talk about security.
• Security is framed as protecting customers and colleagues rather than as a series of prohibitions.
• Rewards, recognition, and gamification can support engagement when they celebrate constructive behavior and avoid exposing individual failures or creating misleading competition.
• Security champions in each department act as local contacts.
• Messages are brief, relevant, and repeated, not annual lectures.
• Feedback loops show people that their reports led to action.

Culture also includes the development of the program itself. Content must be reviewed and updated as threats evolve, for example adding deepfake voice scams, AI-generated phishing, or MFA fatigue attacks. Feedback from users and incident reviews feeds back into the program, a continuous improvement cycle.

8. Worked example: responding to a report

Scenario. At 09:12 an accounts-payable clerk receives an email that appears to come from a regular supplier, "Brightline Packaging." It asks the clerk to update the supplier's bank details before the next payment run and includes a PDF with new account numbers. The sender's address is accounts@brightline-payments.example but the supplier’s real domain is brightline.example. The clerk hesitates and has been trained to use the Report Phishing button. A second clerk, ten minutes earlier, already opened the PDF.

Step 1: classify. This is a business email compromise attempt using a lookalike domain, a type of spear phishing with pretexting. The bank change request is the objective, and the PDF may carry malware or a credential harvesting link.

Step 2: respond to the report. The first clerk reports rather than acting. The security team sees the report, searches every mailbox for the same sender and subject, quarantines the message, and blocks the lookalike domain at the mail gateway.

Step 3: handle the second clerk. Opening the PDF warrants prompt triage, not an automatic conclusion that malware executed. Review attachment analysis, endpoint process/network telemetry, and whether credentials or codes were entered. Use proportionate containment when evidence supports it, with authorized escalation and evidence preservation. A reset or isolation alone is not required solely because a document was viewed.

Step 4: protect the process. Finance reaffirms the control that bank detail changes require a callback to a known phone number and approval by a second person. This directly addresses payment redirection even when the email appears convincing. Use a number from trusted existing records, not the suspicious message; the process still requires consistent enforcement.

Step 5: why other choices are weaker. Telling the clerk to ignore the message would leave other mailboxes exposed. Disciplining the second clerk would discourage future reports. Relying only on awareness training without a verification procedure would leave finance one mistake away from a fraudulent transfer.

Solution. Report, quarantine matching malicious messages, assess the second endpoint and apply evidence-based containment, enforce independent verification for bank changes, and use a suitably anonymized lesson to improve training.

9. Comparison tables

Phishing variants quick map

Behavior types

10. Common pitfalls

• Thinking training alone is enough. Awareness is one layer among many.
• Punishing users who fall for simulations, which reduces reporting.
• Measuring only click rate and ignoring the report rate.
• Running training once a year and calling the job done.
• Giving everyone the same generic content rather than role-based training.
• Confusing spear phishing (targeted) with whaling (targeted at executives) and vishing (voice).
• Treating all unusual user behavior as malicious; it may be risky, unexpected, or unintentional, and the response differs.
• Telling users to forward suspicious email to colleagues instead of using the report button.
• Forgetting that a clean, well-written message can still be phishing.

11. Exam tips

• Exam tip: "targeted email using personal details" is spear phishing; "executive target" is whaling; "phone" is vishing; "text message" is smishing.
• Exam tip: the best defense against BEC is an out-of-band verification procedure, not only spotting suspicious text.
• Exam tip: if a question asks what to do after a user clicks a malicious link, the answer starts with reporting promptly to the security team.
• Exam tip: when asked how to improve a program with a high click rate, pick role-based or recurring training and simulations. When asked how to detect threats earlier, pick improving reporting channels and report rate.
• Exam tip: choose the answer that fosters a no-blame, positive culture over punitive responses to honest mistakes.
• Exam tip: risky, unexpected, and unintentional behaviors are three named categories; read the scenario for intent and normality to choose.
• Exam tip: initial training happens at onboarding; recurring training follows on a schedule and after changes.

12. Mini case study

Situation. Contoso Freight has 1,500 employees. After an incident in which a dispatcher's mailbox was taken over through a credential harvesting page, leadership reviews its awareness program. Findings: training is a single 40-minute video each January with 78% completion; no phishing simulations have been run; users must forward suspicious messages to their manager, who may or may not tell security; two employees were suspended last year after clicking links, and since then the security team has received almost no reports; a warehouse supervisor routinely reuses one password across tools and lets temporary staff use his login to save time; a laptop was lost in a taxi with unencrypted files. The CISO has a limited budget and wants quick wins.

Questions.

1. List the program weaknesses.
2. Propose improvements for training, reporting, and culture.
3. Classify the supervisor's password sharing, the taxi loss, and an employee logging in from two continents in one hour.
4. Which metrics should show whether the improvements work?

Commented solution.

1. The training is annual and generic, completion is incomplete, and there are no simulations or role-based paths. Reporting depends on managers instead of a direct channel. Punishing clickers created a culture of silence. Password reuse, credential sharing, and an unencrypted laptop show that policy, enforcement, and technical controls are also weak.
2. Run a baseline simulation, then recurring simulations with immediate feedback. Add a one-click report button and a monitored security mailbox. Add role-based modules for dispatch, finance, executives, and warehouse supervisors. Replace punishment with coaching and recognition for reporters. Deploy a password manager, MFA, and full-disk encryption, and offer approved temporary accounts so supervisors need not share logins. Provide short monthly micro-lessons.
3. Password sharing and reuse are risky behavior (well intentioned, but dangerous). The taxi loss is unintentional behavior. The two-continent login is unexpected behavior that should be investigated, for example as impossible travel that may indicate compromised credentials.
4. Track training completion, click rate, credential submission rate, report rate, mean time to report, repeated difficulty requiring support, confirmed incident outcomes, and a periodic culture survey. The key early sign of success is a rising report rate and faster reporting.

Key terms

• Security awareness: ongoing effort to teach safe behavior.
• Phishing / spear phishing / whaling: deceptive messages; targeted; targeted at executives.
• Vishing / smishing: voice and SMS phishing.
• Business email compromise (BEC): impersonation to redirect payments or data.
• Pretexting: invented story to justify a request.
• Typosquatting: registering a typing-error variant of a domain; not every look-alike uses this technique.
• Phishing simulation: safe test campaign used for learning.
• Report rate: share of recipients who report a suspicious message.
• Role-based training: content tailored to job function.
• Risky, unexpected, unintentional behavior: the three anomalous-behavior categories.
• UEBA: analytics that detect deviations from normal user behavior.
• OPSEC: protecting sensitive details through careful disclosure.
• No-blame culture: environment that encourages prompt reporting.
• Gamification: using challenges and rewards to encourage good behavior.

Summary checklist

• I can identify phishing, spear phishing, whaling, vishing, smishing, BEC, and pretexting.
• I can design a responsible phishing simulation and explain why report rate matters.
• I can list user guidance topics, including passwords, removable media, OPSEC, remote work, and AI tools.
• I can classify risky, unexpected, and unintentional behavior and choose a response.
• I can describe reporting channels, a user's correct steps after a mistake, and a no-blame culture.
• I can match initial, recurring, and role-based training to needs.
• I can choose metrics that show whether an awareness program is effective.

Sources

• CompTIA Security+ V7 objectives summary (opens in a new tab) — objective 5.6.
• NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program: https://csrc.nist.gov/pubs/sp/800/50/r1/final (opens in a new tab)
• NIST SP 800-61 Rev. 3, Incident Response Recommendations: https://csrc.nist.gov/pubs/sp/800/61/r3/final (opens in a new tab)
• CISA, Avoiding Social Engineering and Phishing Attacks: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (opens in a new tab)
• FBI: business email compromise and payment verification (opens in a new tab)
• NIST TN 2276: Phish Scale User Guide (opens in a new tab)