When should organisations prioritise targeted coaching over broad security awareness training?

Why This Matters for Security Teams

Targeted coaching matters when security behaviour, privilege, or exposure is uneven across the workforce. A generic awareness programme can improve baseline recognition of phishing or unsafe handling, but it rarely changes the habits that matter most in high-risk roles. Security teams should think in terms of control effectiveness: if a small population can approve payments, reset identities, manage secrets, or operate sensitive tools, coaching that reflects those duties will usually outperform broad messaging.

This is especially important where human error and misuse intersect with access. A finance approver, help desk analyst, developer, or privileged administrator needs instruction that is specific to the decisions they actually make, the workflows they use, and the attacks they are most likely to face. That is consistent with the control logic in NIST SP 800-53 Rev 5 Security and Privacy Controls, which expects organisations to match safeguards to risk rather than rely on one-size-fits-all education.

In practice, many security teams discover that the weakest point is not general awareness at all, but a repeated mistake in a specific workflow that only becomes visible after an account takeover, fraud attempt, or privilege misuse has already occurred.

How It Works in Practice

Targeted coaching works best when it is built from evidence, not assumptions. Start by identifying where risk concentrates: privileged access, exception handling, customer data access, payment approvals, code deployment, secrets management, or high-volume user support. Then combine incident history, access review data, and threat intelligence to decide who needs coaching, what they need to change, and how often reinforcement should happen.

The goal is to make the training operational. A broad annual module may teach policy language, but targeted coaching should walk through the real decision points that create risk. For example, a help desk team may need scenario-based coaching on identity proofing and escalation fraud, while developers may need guidance on handling API keys, tokens, and pull-request abuse. Security leaders should also measure whether the coaching changes behaviour, not just completion rates.

• Focus on roles with elevated authority, repeated exceptions, or direct exposure to attack paths.
• Use recent incidents and near misses to shape scenarios that feel realistic.
• Reinforce only the behaviours that reduce the specific risk, not generic policy reminders.
• Track outcomes such as reduced override requests, fewer risky approvals, or fewer repeat mistakes.

Targeted coaching should also account for the surrounding control environment. If detection is weak, if approvals are too loose, or if responsibilities are poorly defined, training alone will not compensate. Best practice is to align coaching with access governance, monitoring, and escalation paths so the same failure does not keep reappearing in different forms.

These controls tend to break down when organisations cannot reliably identify which roles have the highest-risk decisions because job ownership, access records, and operational workflows are fragmented across systems.

Common Variations and Edge Cases

Tighter targeted coaching often increases administrative overhead, requiring organisations to balance precision against the cost of maintaining separate curricula, scenarios, and measurement. That tradeoff becomes more visible in large or fast-changing environments where job roles shift frequently and a single employee may hold multiple responsibilities.

There is no universal standard for this yet, but current guidance suggests a layered model works best: keep a baseline awareness programme for everyone, then add role-based coaching for users whose access or behaviour creates outsized risk. In some cases, the right answer is not more training but a different control, such as just-in-time approval, stronger segregation of duties, or tighter privileged access management.

Another edge case is automation-heavy environments. If AI agents, service accounts, or other non-human identities perform sensitive actions, the coaching target may be the human operators who define permissions, review outputs, or approve exceptions rather than the system itself. That is where identity governance and operational security overlap, and where NHI oversight becomes part of the training design.

Organisations should also avoid using targeted coaching as a substitute for accountability. If a role repeatedly generates incidents, the issue may be process design, tool design, or incentive design, not awareness. In those cases, coaching should support remediation, but it should not be treated as the primary fix.

Related resources from NHI Mgmt Group

• When should organisations prioritise DMARC over more user-awareness training?
• When should organisations prioritise cyber risk scoring over broad security metrics?
• When should organisations prioritise phishing resistant access over more awareness training?
• When should organisations prioritise NHI security over other identity work?