Training

What training means in security roles

Training is the planned transfer of knowledge and practical skill, not a one-time briefing. In security roles, it helps people perform controlled actions consistently, understand approval and escalation paths, and recognise when a task requires extra caution, especially where access, authentication, or privileged handling is involved.

How training supports secure operations

Good training turns policy into repeatable behaviour. It gives staff enough context to complete access requests, validate identity steps, handle sensitive credentials correctly, and understand why certain actions, such as approving access or approving exceptions, require stronger scrutiny than ordinary administrative work.

It also reduces dependence on informal knowledge. When people are trained on the same operating model, the organisation is less likely to rely on memory, tribal knowledge, or ad hoc judgement for tasks that affect access control, user onboarding, privilege assignment, or offboarding.

Where training fails in practice

Training becomes weak when it is treated as a compliance artefact instead of an operational control. If instruction is too generic, too infrequent, or disconnected from real workflows, people may know the rule in theory but still miss important details when handling requests, authenticating users, or reviewing access changes.

Another common failure is role mismatch. A privileged administrator, approver, help desk analyst, or manager needs different training depth from a general employee because each role touches different risks, decisions, and escalation points. Security training works best when it reflects actual duties, not a single organisation-wide slide deck.

Training as part of identity and access governance

In identity and access management, training is part of governance because people must understand not only what to do, but why controls exist and what they are accountable for. That includes request approval discipline, verification before granting access, review of standing access, and the obligation to remove access promptly when roles change or employment ends.

For that reason, training should be linked to the specific control environment a team operates in, including how access is granted, how exceptions are handled, and how privileged work is separated from routine work. NIST Privacy Framework and NIST Cybersecurity Framework 2.0 both reinforce the idea that awareness and role clarity are part of a functioning security programme, while SANS Security Resources is useful for operational security practices that depend on trained people.

Risk and Threat Considerations

Poor training creates exposure because people are then more likely to approve the wrong request, mishandle authentication steps, fall for phishing, or leave access in place longer than intended. In access-heavy environments, that can become a direct path to account compromise, privilege abuse, or unauthorized persistence.

Failure mechanism: Inadequate or outdated instruction leads to inconsistent human decisions at the points where access is granted, validated, or removed, which weakens otherwise sound technical controls.

Impact: The result can be unauthorized access, delayed revocation, excessive privilege, and a higher chance that an attacker can exploit human error to reach sensitive systems or data.

Practitioner Guidance

Why practitioners should care: Training should be designed around the decisions people actually make, not around generic awareness content. The most valuable training is the kind that changes behaviour at the moments where access, approval, review, and offboarding decisions are made.

What to watch for: If teams can recite a policy but still cannot execute the workflow correctly, the training has not been operationalised. That is especially important for managers and approvers, because their actions often determine whether the control works in practice.

Related resources from NHI Mgmt Group

• How should security teams govern access to AI training data?
• How should security teams govern custom foundation model training on proprietary data?
• What should organisations check before relying on a managed training platform for custom AI models?
• How can organisations reduce the risk of secrets in AI training data?