How should security teams personalise awareness training for high-risk users?

Why This Matters for Security Teams

Personalised awareness training is important because broad, generic messaging rarely changes the behaviour of people who already face elevated exposure. High-risk users are often those with privileged access, access to sensitive data, repeated policy exceptions, or a demonstrated tendency to click, approve, or share too quickly. Security teams should treat awareness as a targeted control, not a calendar exercise. The NIST Cybersecurity Framework 2.0 reinforces the need to build awareness into governance and risk management, rather than leaving it as a standalone campaign.

The practical issue is that “high risk” is usually discovered too late if teams rely only on annual training completion. A user can pass a generic course and still be the highest likelihood path for credential misuse, phishing success, or policy bypass. Effective personalisation should therefore be based on identity, access, and behavioural indicators that reflect actual operational exposure. That includes administrator roles, privilege elevation patterns, repeated risky actions, and poor response to simulated attacks. In practice, many security teams encounter the real training gap only after a user account has already been abused or a workflow exception has already become normalised.

How It Works in Practice

The most effective programmes start by defining risk signals that are already available to the organisation. These usually sit across IAM, PAM, endpoint telemetry, email security, and security awareness platforms. The objective is not to profile people in a vague sense, but to identify where behaviour and access create measurable security exposure. Teams should then map those signals to different learning or intervention paths, such as short phishing refreshers, privilege-specific guidance, or just-in-time coaching before a sensitive action.

A practical model often includes:

• Privileged access users who need tighter handling of admin tasks, secrets, and approval workflows.
• Repeat offenders who require focused remediation on the specific behaviour that recurs.
• High-exposure roles, such as finance, HR, legal, IT operations, and executive support, where fraud and impersonation risks are higher.
• Users with poor simulation outcomes who benefit from immediate, context-specific reinforcement rather than a generic module.

Security teams should also align training triggers with access governance. For example, if a person receives temporary elevated access, the training should cover the exact risks associated with that access, not a broad policy summary. If a user repeatedly approves unexpected requests, the intervention should address verification habits and escalation paths. Current guidance suggests this works best when the training is short, specific, and delivered close to the risky event, because retention improves when context is fresh. For broader awareness design, the CISA cybersecurity best practices page is useful for anchoring message themes to real-world controls.

Measurement matters as much as content. Teams should track whether the intervention changes the user’s behaviour over time, not just whether they completed the module. Useful signals include reduced repeat clicks, fewer policy exceptions, better reporting rates, and lower approval of suspicious requests. These controls tend to break down in large organisations with fragmented HR, IAM, and training data because the risk signals are not joined up enough to trigger the right intervention at the right time.

Common Variations and Edge Cases

Tighter targeting often increases operational overhead, requiring organisations to balance better relevance against privacy, governance, and content maintenance costs. That tradeoff is especially visible when training is personalised using behavioural data, because teams must decide how much monitoring is appropriate and who is allowed to see the resulting risk classifications.

There is no universal standard for exactly which signals should qualify someone as “high risk.” Some organisations use only role and privilege level, while others add telemetry such as failed phishing tests, anomalous approvals, or repeated policy breaches. Best practice is evolving here: the more sensitive the intervention, the more carefully the organisation should document why the person was selected and how the data will be used. For environments with stronger regulatory pressure, the ISO/IEC 27001 overview can help frame awareness as part of a broader information security management system.

Edge cases matter. Contractors, shared service desks, and seasonal staff may have high operational exposure but little historical data, so teams should rely more on access context than on past behaviour alone. Executives may have low click rates but very high impersonation value, which means training should focus on fraud resistance, approval verification, and account protection. The most important point is to avoid turning personalisation into punishment. If the intervention feels like surveillance or blame, users will hide risk indicators instead of improving.

Related resources from NHI Mgmt Group

• How should security teams reduce phishing risk without relying only on awareness training?
• How do security and fraud teams measure whether awareness training is actually reducing social engineering risk?
• How should security teams use human risk management instead of awareness training alone?
• How should security teams judge whether AI-powered awareness training is actually reducing risk?