Security awareness training for lean teams: what actually changes?

TL;DR: Small IT teams can run security awareness training by keeping decisions human and automating the repeating work, so one person can move from quarterly campaigns to continuous delivery, monthly trend review, and exception handling without adding a dedicated awareness hire, according to Hoxhunt. The operational constraint is not intent but cadence: repetition, evidence, and follow-up determine whether behaviour changes.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “How can a small IT team run security awareness training?”.

Key questions

Q: What should teams do first when building a security awareness training program?

A: The first step is to build a training plan tied to real risk.

Q: Why do manual security awareness programmes usually lose effectiveness over time?

A: They lose effectiveness because recurring tasks compete with every other IT priority, so cadence drops even when the team still cares.

Q: How can teams tell whether awareness training is actually changing behaviour?

A: Look at the trend, not the attendance sheet.

Practitioner guidance

• Define the human platform split Keep programme decisions with a named owner and move recurring delivery, reminders, and evidence collection onto automation.
• Review monthly behavioural trends Track failure rate, report rate, and time to report each month so the programme measures behaviour change rather than only completion.
• Segment employees into meaningful cohorts Group people by role or exposure so simulations and training reflect the threats each team is most likely to face.

Bottom line: Security awareness programmes do not fail because small teams lack commitment, but because the recurring delivery burden overwhelms normal IT workloads.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →