M1017 User Training: Aiming Training at the Techniques It Can Stop

User Training (M1017) is mapped to more ATT&CK techniques than almost any other mitigation, which makes it easy to over-claim: generic annual awareness training is counted as coverage for 64 techniques while doing little against most of them. ATT&CK v20 links M1017 to phishing, voice phishing, MFA request flooding, OAuth consent abuse, session cookie theft, credential handling, data repository policy and, newly, prompt injection against AI systems. This page sorts those mappings into the handful of behaviours training can actually change, says which audience needs each one, names the technical controls that must carry the rest, and sets out measurements that show effect rather than completion. It is for security awareness leads, identity teams and detection engineers reporting ATT&CK coverage. Programme design basics are in the CIS Control 14 Security Awareness and Skills Training Guide; this page does not repeat them.

Key takeaways

• 64 mappings, about eight behaviours. The v20 relationships collapse into: report phishing, verify callers, reject unexpected MFA prompts, refuse unknown OAuth consent, never type credentials into the wrong domain, keep secrets out of files and chat, install only trusted extensions, and validate AI agent actions.
• Train by role, not by headcount. ATT&CK's own description names help desk staff and executives for role-specific training; developers and administrators carry the credential-handling mappings.
• Training is the weakest layer for phishing. The UK NCSC says no training can teach people to spot every phishing attempt and puts it as one of four layers alongside technical controls.
• Pair every training mapping with a control. Number matching and phishing-resistant MFA for T1621, admin consent workflows for T1528, caller verification procedures for T1566.004.
• Measure reporting, not just clicks. NCSC advises measuring how many people reported a phishing email as well as how many clicked, and warns that valuing an absence of reports incentivises people to keep quiet. Report rate and time to report are better evidence (NHI Mgmt Group view).

What M1017 is in ATT&CK v20

ATT&CK describes M1017 as "educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques". Its listed measures are training tailored to the organisation's risk profile, role-specific training for high-risk staff such as help desk and executives, phishing simulations and social engineering drills, gamified engagement, onboarding content, regular refreshers that include emerging techniques, and real-world case studies.

The v20 dataset holds 64 "mitigates" relationships for M1017, none to revoked or deprecated techniques. They include recent additions such as T1684 Social Engineering, T1684.001 Impersonation, T1667 Email Bombing, T1697 Steal Application Specific Passwords, T1699 Direct Prompt Injection, T1698 Indirect Prompt Injection and T1700 AI-Enabled Exfiltration.

The mappings, grouped by behaviour

The table groups the v20 relationships by the behaviour ATT&CK's per-technique text asks for. The "Priority" and "Audience" columns are NHI Mgmt Group judgements.

Several "user training" mappings are really policy and approval rules: ATT&CK's text for T1072 and T1027 is about restricting access to software deployment systems, and the T1213 family is about publishing policies on what may be stored in Confluence, SharePoint, CRM, databases and chat. Treat those as policy work owned by system owners rather than awareness content.

Implementing the priority behaviours

Help desk and caller verification

ATT&CK's T1566.004 text asks users to be suspicious of callers and verify their identity, and its T1684.001 text suggests confirming requests through an independent channel such as a call back or in person. For the help desk this has to be a procedure, not a judgement call: identity proofing that public information cannot satisfy before any password, MFA or device reset, with privileged account resets needing a second approver. The MGM Resorts breach (2023) is the standard example: a call to the help desk impersonating an employee found on LinkedIn led to identity provider administrator access. See the Vishing and Help Desk Social Engineering Awareness Guide and the Help Desk Identity Verification Policy Template.

MFA prompts (T1621)

ATT&CK asks users to accept only requests from logins they initiated, review the source location and report unsolicited prompts. Training works far better when the prompt itself forces a check: Microsoft documents that number matching is enabled for all Microsoft Authenticator push notifications and cannot be opted out of, requiring the user to type the number shown on the sign-in screen. In the Uber breach (2022) repeated push prompts wore down a contractor until one was approved. See the MFA Fatigue and Bypass Guide and Phishing-Resistant MFA Guide.

OAuth consent (T1528)

ATT&CK's text asks users not to authorise third-party applications they do not recognise, to check for misspelled or convoluted redirect URLs and to be cautious about the permissions requested. The application that receives consent becomes a non-human identity with standing access to mail or files, which outlives a password reset. Pair training with restricted user consent and an admin approval workflow. See the Consent Phishing and Illicit OAuth Grants Guide and How to restrict user consent to apps in Entra ID.

Secrets and credential handling

The developer and administrator mappings (T1552.001 plaintext passwords in configuration files, T1552.008 passwords shared in chat, T1003 password reuse across accounts) are best taught alongside the tools that make the right path easy: a vault, a secret scanner with pre-commit hooks, and a supported way to share a credential once. See M1013 Application Developer Guidance.

AI-enabled systems

For T1698 Indirect Prompt Injection, ATT&CK asks users and administrators to treat content processed by AI agents as potentially adversarial and to validate independently before approving sensitive actions an agent proposes. The audience is small and identifiable: people who approve agent actions or own agent configuration. See the OWASP LLM Top 10 LLM01 Prompt Injection Guide.

Rolling it out

1. Map roles to behaviours: use the table to decide who needs which module; most staff need three behaviours, the help desk and administrators need more.
2. Fix the reporting path first: NCSC recommends a reporting process that is "clear, simple and quick to use" with feedback to the reporter. Without it, training has nowhere to send people.
3. Put the matching control in place before or alongside each module: number matching, consent restrictions, help desk procedure, extension allow-list.
4. Pilot simulations with HR agreement: NCSC cautions that punishing staff for clicking test emails can create legal risk and erode trust. Start with one department and a no-blame policy.
5. Run drills for the high-risk roles: vishing calls to the help desk and payment-change requests to finance, measured against the written procedure.
6. Refresh from incidents: update content when a new lure appears in your own reports, as ATT&CK's "emerging threats" measure suggests. Roll back any simulation type that drives report rates down.

What M1017 does not stop

• Adversary-in-the-middle phishing that proxies a real login page defeats careful users and push MFA; only origin-bound authenticators break it. See the AiTM Phishing Guide.
• Credential theft that needs no user action, such as infostealers on personal devices or exploited services.
• Non-human identities: service accounts, API keys and agents cannot be trained; their protection is scoping, rotation and monitoring.
• Insider misuse: training changes accidental behaviour, not intent.

Common failure patterns

• Completion rate reported as coverage: 98% completion says nothing about whether the help desk verifies callers.
• Help desk trained but no procedure: staff are told to "be suspicious" yet have no approved verification method, so helpfulness wins.
• Click-rate targets: staff learn to ignore suspicious mail rather than report it; NCSC warns that valuing an absence of reports incentivises people to keep quiet.
• Push MFA without number matching: training asked to do the work a control should do.
• Consent left open to all users: one approved prompt grants a third-party application lasting access.
• One module for everyone: developers never hear about secrets in chat; executives never rehearse payment fraud calls.

Measuring effect

Framework mapping

Practitioner checklist

• Group your M1017 claim into the eight behaviours and assign each to named roles.
• Make phishing reporting one click, with feedback to the reporter.
• Write and drill a help desk identity verification procedure that public information cannot satisfy.
• Turn on number matching or phishing-resistant MFA before training on MFA prompts.
• Restrict user consent to applications and run an admin consent workflow.
• Teach developers and administrators secrets handling alongside the vault and scanner they should use.
• Train approvers of AI agent actions to validate proposed actions independently.
• Agree simulation rules with HR and avoid punishment for clicks.
• Report report rate, time to report and drill results, not completion alone.

Standards and references

• MITRE ATT&CK: User Training (M1017)
• NCSC: Phishing attacks, defending your organisation
• NIST: SP 800-50 Rev. 1 Building a Cybersecurity and Privacy Learning Program
• Microsoft Learn: Number matching in multifactor authentication push notifications
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: CIS Control 14 Security Awareness and Skills Training Guide · Phishing Simulation Programme Guide · Vishing and Help Desk Social Engineering Awareness Guide · MITRE ATT&CK Coverage Mapping Guide