Whilst we design some amazing e-learning, integrating effective learning practices, and supporting organisations in meeting their Duty of Care obligations through education, that is not all we do. We have been working with clients around the world to design effective security campaigns so that the learning really lands. What we always hope, and guides how we design our approach, is that training doesn’t just increase someone’s knowledge, but changes how people think, behave and make decisions every day.
Here’s what we’ve learnt:
Creating an Effective Hook
The first hurdle is getting people interested. This isn’t just about making training or awareness campaigns visually appealing, reducing Cognitive Load (Sweller, 1988; Lewis, 2016), or making training mandatory.
It’s about selling the need (this is generally good andragogical practice, Knowles, 1984) in a way that everyone understands. We all know security is important. All of your staff know security is important. But they need to know why it is important, and how it impacts them.
You can do this in many ways. Really engaging ‘trailer’ style videos, catchy blog posts on SharePoint or similar, and explaining the journey early on work well.
Selling the Training
If staff find security training dull, irrelevant, or patronising, cultural change is unlikely to follow. Effective security programmes focus on:
- Realistic scenarios employees actually face,
- Clear links between security behaviours and personal impact,
- Short, focused content rather than long, generic courses.
This all needs to be relevant. If the language is forced, if the scenarios are inappropriate, or the training is too generic, then people will naturally switch off.
Opportunity to be Involved
Training shouldn’t be one-way. Any good classroom trainer knows this. But it becomes much harder to do this during e-learning, without it feeling forced. It is also important that those taking part have the opportunity to practice what they are learning (in instructional design, this is known as ‘eliciting performance’, Gagné, 1985)
We have found that realistic, interactive scenarios work well. But only when these look and feel like real life. For our travel training, we do this by basing scenarios on real-life case studies, hiring actors and making sure everything looks realistic, from the setting right down to the props.
Maintaining Momentum
Doing training well is one thing, but keeping people along for the journey is another. You need to build momentum. This isn’t just about regularly dropping new content; it’s about making it relevant, mixing e-learning , narrative videos, blog articles, and shorter advice videos, and packaging it in a way that makes sense. The cadence needs to be regular, but not so common that security becomes boring through overload. And it needs to be sincere. Publishing security content and tagging it to an international day that doesn’t make sense loses your audience.
Review and Reassess
There is no perfect formula for an effective campaign. You won’t always get it right, even with the best intentions. So, reviewing metrics is important. This might be e-learning feedback scores, organisation-wide self-assessment surveys (short, 5-question surveys work well), or tracking interaction (such as through SharePoint views).
This also includes asking those who see security behaviour every day. Reception staff, local security or facilities teams, and site managers. You are not looking to assess ‘knowledge’ (do staff know the right thing to do), but behaviour (are they doing what they should). This isn’t the same as the ‘eliciting performance’ from before, but an honest look at what is happening, and measuring trends (Kirkpatrick & Kirkpatrick, 2006).
The trick is to then look at the results and adjust what you are doing. The cadence might need to change, or you might need to lean into different mediums for the message (like one of our clients has recently done with a series of Netflix-style films), or you might need to focus in on one specific aspect. And this is why reviewing data is so important – it will highlight exactly how you need to change your approach.
Keep At It!
Designing fun, interactive and impactful training is easy really hard work, and takes a lot of planning. But changing a security culture is even more challenging. And there will undoubtedly be hurdles. Each company is unique, and so it each culture. The main thing is to stick with it. You won’t change a culture overnight, but small, regular course corrections add up over the long term.
Gagné, R. M. (1985). The conditions of learning and theory of instruction (4th ed.). New York, NY: Holt, Rinehart & Winston.
Kirkpatrick, D. L., & Kirkpatrick, J. D. (2006). Evaluating training programs: The four levels (3rd ed.). Berrett-Koehler.
Knowles, M. (1984) Andragogy in Action. San Fransisco, Jossey-Bass.
Lewis, P. (2016). Brain friendly teaching—Reducing learners’ cognitive load. Academic Radiology, 23(7), 877–880.
Sweller, J. (1988). Cognitive load during problem solving: Effects on learning. Cognitive Science, 12(1), 257–285.
