What should security teams do when standard training does not address the highest-risk users or groups?

Security teams should personalise training to the people and groups that show the most risk. A generic programme wastes effort when different employees face different threats and have different exposure levels. Targeted interventions, driven by current behavioural data, help teams focus on the users most likely to create or experience incidents and improve overall programme relevance.

Why This Matters for Security Teams

Generic awareness programmes usually fail because they treat the workforce as one audience. The more useful approach is to segment by exposure, behaviour, and business context, then tailor training to the people most likely to encounter the relevant threat. That shifts training from compliance activity to a control that can reduce phishing success, data handling mistakes, and risky exception handling where it matters most.

Targeted training also gives security teams a better way to spend limited time and attention. If a group handles sensitive payments, external communications, or privileged workflows, the content should reflect those realities rather than repeat broad advice that most participants already know. In practice, many teams discover the highest-risk users only after an incident review exposes patterns that were visible in the data all along.

How It Works in Practice

Risk-based training starts with identifying which groups create the greatest exposure and why. That usually means combining behavioural signals, role context, incident history, and control exceptions rather than relying only on job title. A team might find that one group needs stronger phishing resistance, another needs better handling of sensitive data, and a third needs repeat coaching on approval bypasses or unsafe workarounds.

The training itself should then change in three ways: content, timing, and measurement. Content should reflect the threats the group actually faces. Timing should follow observed risk moments, such as onboarding, policy changes, major system migrations, or repeated control failures. Measurement should go beyond attendance and include whether the targeted behaviour improves after the intervention.

Use current behavioural data to decide which groups need intervention first.
Match the scenario to the group’s actual workflow and threat exposure.
Track whether the targeted behaviour changes after training, not just whether users completed it.
Refresh the content when threat patterns or business processes change.

This works best when security, HR, and operational leaders agree on which signals justify extra attention and when a coaching intervention should become a formal control requirement. These controls tend to break down when organisations try to scale one static course across very different user populations.

Common Variations and Edge Cases

Tighter targeting often increases operational overhead, so organisations have to balance relevance against the cost of maintaining multiple training paths. That trade-off is usually worth it for the highest-risk groups, but not every audience needs a fully bespoke programme.

Some teams should use a blended model: a common baseline for everyone, then short targeted modules for the groups with the most exposure or the worst historical outcomes. That is often more sustainable than trying to customise every lesson. Where current guidance is still evolving, the practical rule is to personalise where risk clearly differs, and keep the baseline consistent where the threat profile is similar.

Another edge case is overfitting training to one recent incident. A single event can reveal an important gap, but it should not define the whole programme if the underlying risk is broader. Good teams look for recurring patterns, not one-off anecdotes, and they avoid confusing novelty with priority.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	14 — Security Awareness and Skills Training	This question is about tailoring awareness to risk-prone groups.
Recommendation — Segment training by risk and measure whether targeted behaviors improve.
NIST CSF 2.0	PR.AT — Awareness and Training	The subject is security training design and effectiveness by audience.
	GV.RM — Risk Management Strategy	Personalised training should be driven by current risk signals and exposure.
Recommendation — Align awareness content to user risk and verify it changes behavior. Use risk data to prioritise which groups receive targeted training first.

Practitioner Guidance

What to prioritise: Start with the groups whose behaviour, access, or exposure makes a real incident most likely, then tailor content to the failure mode you are trying to reduce. If the same issue keeps recurring, treat it as a control gap, not just a training gap.

What to verify: Confirm that the targeting logic is based on current data, not stale assumptions about role or seniority. A useful programme should show a measurable difference in completion quality, follow-on behaviour, or incident reduction for the targeted population.

Common mistake: Do not build a more detailed curriculum for everyone when only a few groups carry most of the risk. Broad awareness still has value, but it should not replace focused intervention where exposure is concentrated.

Practitioner takeaway: The goal is not more training, it is better risk reduction, which means aiming the most specific intervention at the people most likely to break, bypass, or be targeted by the control.