How to run training that works — short, frequent, humane simulations, a celebrated report button — is the content question. This article is the container question: how training becomes a program — a system with a calendar, named roles, and metrics, that keeps running when the enthusiastic person who started it gets busy. The distinction matters because awareness efforts fail in a predictable way: a strong launch, three good months, then quiet lapse — and lapsed awareness decays fast, because the attacks keep rotating while the training stops. A program is the structure that outlasts the enthusiasm. Here’s its anatomy.
The calendar: twelve months, decided once
The program’s spine is an annual calendar, built in one sitting: monthly — the short lesson and the simulation, pre-scheduled through the platform so lapsing requires stopping something rather than remembering it · seasonal alignment — the tax-scam module ahead of filing season, delivery-phish before December, wire-fraud refreshers timed to your industry’s payment cycles · quarterly — one role-targeted campaign (finance gets the payment-redirect scenario, HR the payroll-change one, leadership the impersonation-of-them briefing) · and annually — the policy re-acknowledgments (acceptable use, data handling, AI rules) folded in, so compliance paperwork rides the program instead of being its own nagging cycle. The calendar’s superpower is mundane: dated things happen; intended things don’t.
The roles: an owner, a sponsor, and champions
Three assignments convert activity into a system. The program owner — one name accountable for the calendar running, the platform administered, the metrics reported; in a managed relationship the mechanics can be the provider’s (ours ships with the plan), but the internal owner still exists, because a program nobody inside owns is a subscription, not a culture. The executive sponsor — leadership doing the training visibly, saying the no-blame rule out loud, and repeating the “I will never ask by email” pledge; sponsorship is ten minutes a quarter and it’s the difference between a program and an IT initiative people tolerate. Champions — one person per team who gets findings early, fields the “is this legit?” questions locally, and feeds back what’s confusing; informal, unpaid, and disproportionately effective, because people ask the colleague before they ask the help desk.
The integrations: where the program plugs into everything else
A program earns “system” status by connecting: onboarding — the essentials in week one, automatically, because new hires are targeted precisely while they’re new · real incidents become curriculum — the phish that actually hit the company, defanged, as next month’s two-minute lesson; nothing teaches like local evidence · the report button wires into the response layer — reports triaged, campaigns purged, reporters thanked, closing the loop that makes reporting feel consequential · and the policies reference the program and vice versa, so the rules and the training tell one story.
The metrics: proving it, honestly
A program reports; an activity just happens. The quarterly page: report rate and report speed (the numbers that predict real outcomes — both should climb) · click rate (watched but not worshipped — it plateaus; that’s the attention ambush being real) · completion rates by team (lapses visible before they’re cultural) · and the qualitative line — the near-miss narratives where someone’s training visibly worked, which is the metric leadership actually remembers. Feed it all into the quarterly review and the annual security pass, where the program gets the same honest grading as every other control — and where insurers’ training questions get answered with evidence instead of assurances.
The bottom line
Training is what happens in a month; a program is what makes sure next month happens too: a twelve-month calendar decided once, an owner and a visible sponsor, champions in the teams, integrations into onboarding and incident response, and metrics that climb where it matters. Build the container and the content largely runs itself — which was the goal all along: awareness as the company’s standing habit, not its occasional resolution.