Neurodiversity and Awareness Training: Designing Security Training That Lands

Most security awareness content is designed for one imagined learner, so neurodivergent staff often meet training that is dense, timed, full of idioms and built around trick questions that test reading speed rather than security judgement. Acas describes neurodiversity as natural differences in how people's brains work and process information, and lists ADHD, autism, dyslexia, dyspraxia, dyscalculia and Tourette's syndrome among the conditions people commonly mean. This guide covers one narrow job: designing and delivering awareness content, phishing simulations and assessments that work for neurodivergent staff, which in practice makes them work better for everyone. It is written for awareness leads, learning designers, HR partners and the people who configure awareness platforms. For programme design and platform selection, see the Security Awareness and Human Risk Management Guide and the Security Awareness Training Buyer's Guide.

Key takeaways

• Design for the range, not the average. Clear words, short steps, no time limits and a consistent layout help autistic, ADHD and dyslexic learners and also help tired, rushed or second-language staff.
• Literal language is a security control. Training that says "never" and then shows exceptions, or relies on idioms and sarcasm, teaches the wrong rule to literal readers; state the exact behaviour you want.
• Test judgement, not speed or memory. Remove countdown timers, let people go back, and give reference cards for procedures such as how to report, so recall is not the thing being assessed.
• Simulations need extra care. The NCSC warns that punishing clicks "starts to resemble entrapment" and that simulations "erode trust"; for staff who already mask or experience anxiety, a blame-driven programme can stop reporting altogether.
• Adjustments are a legal duty, not a favour. Under the Equality Act 2010 section 20 the duty to make reasonable adjustments can include giving information in an accessible format, which covers mandatory security training.

Why standard awareness content misses neurodivergent staff

Awareness content tends to share a set of habits that cause friction for different neurotypes. None of them make the training more secure, and most come from course templates rather than deliberate choices.

• Dense text and long modules: long annual courses with paragraphs of policy text are hard for dyslexic readers and for people with ADHD who lose focus in long passive segments. NIST SP 800-50 Rev. 1 recommends breaking content into smaller pieces and supporting "a diverse workforce, including those with accessibility requirements".
• Figurative language: "Don't take the bait", "red flags", "think before you click" and jokes about "the weakest link" are idioms. The UK Government accessibility posters advise against figures of speech and idioms for autistic users.
• Trick questions: quizzes with double negatives ("Which of these is not an unsafe action?") test reading, not security. The British Dyslexia Association style guide says to avoid double negatives.
• Time pressure: countdown quizzes, auto-advancing slides and session timeouts penalise slower readers and people who process carefully. WCAG 2.2 success criterion 2.2.1 Timing Adjustable (Level A) exists for this reason.
• Sensory load: flashing "alert" animations, sirens, bright red and green, and autoplay video with music. The posters advise calm, simple colour schemes for autistic users, and WCAG 2.2 criterion 2.3.1 limits flashing content.
• Shame-based framing: leaderboards of clickers, "you failed" banners and mandatory remedial courses for one click. Acas notes that neurodivergent workers may mask parts of their condition to fit in, which can cause exhaustion; public failure signals push people further into hiding mistakes.

Design principles mapped to sources

The W3C Cognitive and Learning Disabilities Accessibility Task Force note "Making Content Usable for People with Cognitive and Learning Disabilities" (a Working Group Note, supplemental to WCAG) groups its guidance into eight objectives. The table maps the ones that matter most for awareness content to concrete design decisions.

Writing security content that literal readers get right

Security rules often contain hidden exceptions. A literal reader takes the rule as written, so the content must carry the exception explicitly or the learner will either break the rule or refuse legitimate requests.

Use concrete examples rather than abstract warnings: a screenshot of a real phishing email with each sign labelled works better than a list of adjectives. The BDA style guide recommends supporting procedures with images, pictograms and flow charts, which suits reporting and verification steps well.

Phishing simulations with neurodivergent staff

Simulations are where poorly designed programmes cause the most harm. The NCSC phishing guidance says no training package "can teach users to spot every phishing attempt", that "blaming users for clicking on links doesn't work", and that "employees who are afraid for their jobs will not report mistakes". It recommends checking with HR before running simulations. For neurodivergent staff, specific design choices reduce harm:

• No punishment and no public scores: no named league tables, no manager escalation for single clicks, no automatic disciplinary route. Acas gives an example of a "zero-tolerance" policy that left no room to consider a dyslexic employee's behaviour; apply the same thinking to simulation consequences.
• Feedback that teaches: the landing page after a click should be calm, short and specific: two or three signs, one action, and a link to report. Avoid alarm graphics, sirens or flashing banners.
• Celebrate reporting: measure and thank reporters. The NCSC suggests measuring successes such as how many people reported a phishing email, not just clicks, and encourages reporting even after clicking.
• Avoid emotional lures that cross a line: fake bonus, redundancy, health or disciplinary lures cause real distress, and can be acute for staff who experience anxiety. Use lures that mirror real attacks on your organisation (invoice, delivery, shared document) instead.
• Offer an alternative route: where an employee has an agreed adjustment, allow them to take part in a different activity, such as the NCSC-suggested exercise of crafting phishing emails, rather than being excluded or simply skipped.

See the Phishing Simulation Programme Guide for campaign mechanics; this guide only covers the inclusive design layer.

Adjustments, privacy and legal position

Acas states that being neurodivergent will often amount to a disability under the Equality Act 2010, and that disabled employees have a right to reasonable adjustments. Section 20 of the Act sets three requirements (provisions, criteria or practices; physical features; auxiliary aids), and where information is involved the reasonable steps can include providing it in an accessible format. Mandatory security training and tests are a practice of the employer, so the duty applies to them.

• Do not require disclosure: build inclusive defaults (no timers, multiple formats, adjustable text) so most people never need to ask. Acas notes that some neurodivergent people do not see themselves as disabled.
• Make requests simple: publish a short line in every course ("Need this in another format, more time or a different activity? Contact [team]") and route it to HR or the awareness lead, not the SOC.
• Keep adjustment data separate: health and disability information is special category data under UK GDPR. Do not store adjustment flags in the awareness platform's user profile or human risk score; record only the delivery setting needed (for example, "extended time").
• Scores are not performance evidence: click rates and quiz scores must not feed performance reviews in a way that disadvantages people whose results reflect reading speed or format barriers rather than security behaviour.

Outside the UK, check local disability and equality law before relying on this section; the design practices apply everywhere.

Choosing formats: what to use when

No single format suits everyone, so the decision is about offering a sensible set of equivalents for each lesson, not choosing one.

Small organisations: start with inclusive defaults in whatever tool you already have: turn off timers, add captions, rewrite the reporting instructions in plain language and publish a reference card. Large organisations: add accessibility requirements (WCAG 2.2 AA conformance, adjustable timing, multiple formats, separation of adjustment data) to the platform RFP and test them with neurodivergent staff during the proof of concept. See the Security Awareness Training Buyer's Guide.

How to implement

1. Audit current content: list every mandatory module, quiz and simulation template. For each, record length, timers, auto-advance, captions, idioms, double negatives and sensory effects. This gives a baseline in a few days.
2. Involve neurodivergent staff: invite volunteers, through a staff network if one exists, to review a sample. Pay attention to where they stopped, guessed or misread the rule. Keep participation voluntary and confidential.
3. Fix platform settings first: disable quiz timers and auto-advance, enable captions and transcripts, allow retries and back navigation, and turn off flashing or siren effects on simulation landing pages. These changes are quick and reversible.
4. Rewrite the highest-traffic content: start with the reporting procedure, password and MFA rules, and the simulation landing page, using the literal-language table above.
5. Pilot with a ring: release revised modules to one department plus the volunteer group. Compare completion time, quiz retries, reporting rate and survey comments with the old version.
6. Publish the adjustment route: a single line in every module and on the intranet, routed to HR or the awareness lead, with a target response time.
7. Roll out and keep the old version available: if a revised module causes confusion, revert that module only while you fix it; the platform settings changes rarely need rolling back.
8. Review annually: add the inclusive design checks to the content review that CIS Control 14 and your policy already require.

Detection and measurement

NIST SP 800-50 Rev. 1 states that learning programme measurements "must go beyond simply achieving compliance" and lists behaviour change, engagement and qualitative feedback alongside completion. For inclusive design, measure:

• Reporting rate per simulation and for real suspicious messages: the primary outcome; it should rise or hold after the redesign.
• Median time to report: shows reporting has become habitual rather than hesitant.
• Quiz first-attempt pass rate against retry rate: a high retry rate on one question usually signals confusing wording, not a knowledge gap.
• Abandonment points: the slide where learners drop out or pause longest; long modules and timed sections show up here.
• Adjustment requests and time to fulfil: requests should fall as defaults improve; fulfilment should take days, not weeks.
• Anonymous survey items: "I understood exactly what to do" and "I felt comfortable reporting a mistake", split by department, never by disclosed condition.

Framework mapping

See the CIS Control 14 Security Awareness and Skills Training Guide.

Common failure patterns

• Treating accessibility as screen reader support only: a module can pass basic screen reader checks and still be timed, idiom-heavy and 40 minutes long. Cognitive accessibility needs its own review.
• Absolute rules with silent exceptions: "never click links" leads literal readers either to refuse real work or to decide the rule is meaningless. Write the precise condition.
• Remedial training as punishment: auto-enrolling every clicker into a longer course doubles down on the format that did not work and signals blame, which the NCSC warns stops reporting.
• Adjustments stored in the risk platform: putting disability flags in a human risk score or user profile creates special category data in a security tool and exposes people to profiling.
• Alarm-style landing pages: flashing red banners and sirens after a simulated click add sensory load and shame, and teach nothing.
• Designing for neurodivergent staff without them: guidelines are a start, but only testing with real users shows which wording is misread in your context.

Practitioner checklist

• Quiz timers, auto-advance and session timeouts are off by default in the awareness platform.
• Every video has captions and a transcript; no autoplay, flashing or siren effects.
• Reporting, password and MFA rules are rewritten in literal, single-action sentences with no idioms.
• Each mandatory lesson exists in at least two equivalent formats (text with images, captioned video or audio).
• Quizzes have no double negatives, allow back navigation and explain each answer.
• Simulation landing pages are calm, short and teach two or three signs plus the report action.
• No named leaderboards, manager escalation for single clicks or punitive remedial courses.
• A simple adjustment route is published in every module and routed outside the security tooling.
• Adjustment and disability data are kept out of the awareness platform and risk scores.
• Neurodivergent volunteers review new content before it goes to the whole workforce.

Standards and references

• W3C: Making Content Usable for People with Cognitive and Learning Disabilities
• W3C: Web Content Accessibility Guidelines (WCAG) 2.2
• NIST: SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program
• NCSC: Phishing attacks, defending your organisation
• UK legislation: Equality Act 2010, section 20, Duty to make adjustments
• Acas: Neurodiversity at work
• British Dyslexia Association: Dyslexia friendly style guide
• GOV.UK Accessibility blog: Dos and don'ts on designing for accessibility

Related NHI Mgmt Group resources: Security Awareness and Human Risk Management Guide · Phishing Simulation Programme Guide · Security Culture · Role-Based Security Training Programme Guide