Security awareness training that counts

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · Compliance

Awareness training is mocked because most of it is theatre. Done right it is one of the cheapest defences against the attacks that actually land.

Why it is required

People are the most-attacked layer — phishing and social engineering start most breaches. Frameworks require security awareness training because the human control is real: a workforce that recognises a phishing email and knows how to report it stops attacks no tool catches. It is a required control in SOC 2, ISO 27001, PCI, and HIPAA.

What to cover

Keep it relevant: phishing and social engineering, passwords and MFA, safe data handling per your classification scheme, device security, and — crucially — how to report something suspicious. Tailor a slice for higher-risk roles (engineering, finance, admins) who are targeted differently.

The evidence

Auditors want completion records linked to your actual roster: every employee, trained at onboarding and on an annual cadence, with dates. The gap that causes exceptions is the new hire who never got trained or the lapsed annual — tie training to onboarding and a recurring schedule.

Measure behaviour, not attendance

A watched video is not changed behaviour. Periodic phishing simulations show whether the training works and give you a metric that improves over time. SentinelPanda tracks training completion against your roster and stores the records as evidence.