Why Combining Compliance and Cybersecurity Training Makes Your Programme Stronger

Strategy 1: Start With Goals, Not Content 

Think about what your organisation actually needs to achieve before picking specific topics. 

Do you need to reduce phishing click rates? Demonstrate compliance readiness for a cyber insurance renewal? Satisfy FCA training requirements? Define the outcomes first and work backwards. 

Not every employee needs the same training; your goals can vary across teams. A finance controller under FCA oversight may need the full financial crime and conduct risk module, while a warehouse operative needs only a basic data handling overview. Map content to roles from the outset and avoid content overload. 

Strategy 2: Vary Your Content and Test Regularly 

Different teams learn differently. IT-literate staff may prefer interactive scenarios while finance professionals may want case study-led content that reflects real-world incidents in their sector. 

Work with a training provider that offers a wide library of formats, and either tailor the content yourself or work with them to select it. Variety keeps engagement high. 

Simulated phishing tests should sit within the content mix, not outside it. While they’re often seen just as a measurement tool, they should also be used as a training mechanism. Monthly simulated phishing tests are a sensible minimum.  

Don’t forget real attackers use varied, well-crafted approaches. Your tests should reflect that variety. Threading compliance and security content together in the same programme also removes the disconnect employees notice when the two feel unrelated. A module on client data handling followed by a scenario about a targeted phishing attack using that data drives the message home. 

Strategy 3: Keep It Front of Mind Between Sessions 

Training isn’t only what happens inside a module. It plays out in regular communications, brief reminders, internal updates, team briefings. Reinforce key messages between formal sessions. 

A short monthly update to staff, a slide in the all-hands meeting, or a pinned post in your Microsoft Teams channel can all contribute to keeping security and compliance visible throughout the year. 

If your business has a director, partner, or owner willing to add their name to a brief message about why this matters, use that. Their influence will be much greater. The tone across all communications should be positive and practical. The goal is to help employees understand why this matters to them personally, not just to the business.  

Strategy 4: Measure What Actually Matters 

Not every metric you can track is worth tracking. In training programmes, it’s easy to generate numbers that look impressive but tell you very little about whether behaviour has actually changed. 

Metrics that indicate real change: 

• Phishing simulation click rate over time - this is your most direct behavioural indicator. Track it consistently, across varied template difficulty levels. A meaningful downward trend over 6–12 months is genuine evidence that training is working. 

• Reporting rate - are employees actually reporting suspicious emails rather than just ignoring or deleting them?  

• Repeat clickers - individuals who click on multiple phishing simulations across several months need targeted intervention, not just another generic module.  

• Pre- and post-assessment scores - if you run a knowledge assessment before the programme launches and repeat it at six or twelve months. This is also useful evidence for regulators and insurers. 

• Incident response behaviour - are staff reporting suspected incidents faster? Are they following the correct procedure when they think something has gone wrong?  

Measurement should start before the programme launches. An initial assessment across both security awareness and compliance knowledge gives you a baseline. From there, you can identify gaps, prioritise content, and track genuine progress.