When should organisations move from completion-based SAT to behaviour-based training?

Why This Matters for Security Teams

Completion-based security awareness training is easy to report and hard to trust. It measures attendance, not whether people notice phishing, protect secrets, or pause before approving a risky workflow. That gap matters most when organisations are dealing with credential theft, AI-assisted social engineering, or repeated user-driven incidents that survive every annual training cycle. Guidance from the NIST Cybersecurity Framework 2.0 points teams toward measurable risk reduction, not checkbox completion, and NHIMG research on the The State of Secrets in AppSec shows how human behaviour around secrets still creates exposure even in mature programmes. The practical question is not whether training was finished, but whether behaviour changed in ways that reduce the attack path. In practice, many security teams discover the limits of completion-based SAT only after the first repeat incident, rather than through intentional measurement of behaviour change.

When that happens, the training programme is no longer acting as a control. It has become administrative proof that a course was assigned, while the real risk remains in mailbox clicks, credential reuse, unsafe approvals, and failure to report suspicious activity fast enough.

Behaviour-based training becomes the right move when the organisation wants evidence that people can apply security judgment under realistic conditions. That means measuring response quality, not just whether a module was opened.

How It Works in Practice

Behaviour-based training uses observed actions to shape the next intervention. Instead of one annual course for everyone, the organisation creates targeted practice loops based on the behaviours most likely to cause loss. That can include simulated phishing, just-in-time coaching after risky actions, role-specific exercises for finance or developers, and follow-up for users who repeatedly miss the same scenario. The aim is to measure whether people recognise, report, and avoid risky behaviour when pressure is real. Useful programmes usually combine three elements:

• Risk signals from incidents, phishing reports, leaked secrets, and unsafe approval patterns
• Short, role-specific exercises that test recognition and decision-making in context
• Metrics that track behaviour change over time, such as report rates, click rates, secret handling, and time to escalate

This approach aligns better with current guidance from the NIST Cybersecurity Framework 2.0, which emphasises governance, measurement, and continuous improvement. It also fits the reality described in LLMjacking: How Attackers Hijack AI Using Compromised NHIs, where compromised credentials become dangerous quickly once exposed. Behaviour-based training is most effective when it is tied to the exact actions that create exposure: approving unexpected MFA prompts, pasting secrets into unsafe tools, or failing to verify unusual requests. Teams should treat it as a feedback system, not a punishment model.

These controls tend to break down when training data cannot be linked to actual incident patterns because the programme then optimises for activity volume instead of risk reduction.

Common Variations and Edge Cases

Tighter behaviour tracking often increases programme overhead, requiring organisations to balance better risk insight against privacy concerns, manager workload, and user fatigue. Some environments still need completion-based SAT for regulatory proof or broad baseline coverage, especially in highly regulated sectors or large workforces with limited telemetry. Best practice is evolving here: there is no universal standard that says completion must disappear entirely. The key is to stop treating completion as the primary success measure once behaviour data is available. A few edge cases matter:

• New joiners may need completion-based onboarding first, then behaviour-based reinforcement after 30 to 90 days.
• High-risk roles such as finance, IT admins, and developers usually benefit from earlier behaviour-based measurement.
• Low incident volume does not always mean low risk if reporting rates are poor or phishing simulations are too predictable.
• AI-enabled phishing can flatten old metrics quickly, so training design must evolve with attacker tactics.

NHIMG research on the The State of Secrets in AppSec shows why behaviour matters: organisations can be confident in their controls while still failing at day-to-day secret handling. The practical rule is simple: keep completion for documentation where needed, but move to behaviour-based training as soon as repeat incidents show that awareness has not translated into action.

Related resources from NHI Mgmt Group

• How should organisations use role-based homepages in governance platforms?
• What is the difference between role-based access and API key governance for NHI security?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?