Security Awareness Training: Online, In-Person or Phishing Tests?
E-learning platform, in-person workshop, phishing simulations or a combined annual program: engagement, measurement, cost model, French content and evidence.
Facts verified : October 2026This comparison is not sponsored.
Our recommendation for your situation
12-person Québec City firm starting from scratch
In-person workshop
A first session built around your own emails and tools creates a shared baseline and gets people talking. Then add short refreshers: one session a year isn't enough.
60-employee distributor on three sites, with evening shifts
E-learning platform
Short modules available at any hour reach every shift, and completion records keep themselves. If you operate in Québec, make sure the content is genuinely available in French.
120-employee company filling out an insurance questionnaire and documenting Law 25 compliance
Combined annual program
Baseline training, refreshers, simulations and modules for leadership and finance, all in an annual plan: that's what produces solid evidence and a measure of effectiveness, as Québec's privacy regulator (CAI) suggests.
Side-by-side comparison
Criterion
E-learning platform
In-person workshop
Phishing simulations
Combined annual program
Employee engagement
Variable: good if modules are short and refreshed
High during the session
High in the moment; fragile if the approach is punitive
The most sustained: short, frequent messages all year
Measurability
Completion and quiz scores, per employee
Attendance, unless you add a quiz
Reporting and click rates, per campaign
Completion, reporting and trends year over year
What it builds
Knowledge
Knowledge and discussion
The reflex in front of a realistic email
Knowledge, reflexes and role-specific responsibilities
Role-based content
Depends on the platform (role-based paths)
Yes: content tailored to the group
Yes: campaigns by department
Yes: baseline for all, modules by role
Cost model
Licence or subscription, often per user
Per session, plus staff time
Tool or service, often per user
Sum of the components over the year
French availability
Variable: check the content, not just the interface
Yes, if the trainer offers it in French
Depends on the tool: check lure emails and training pages
Require it for every component
Evidence for Law 25 and insurers
Individual training records
Attendance sheets and material presented
Campaign reports: reports, clicks, training completed
Baseline training for everyone, short refreshers all year, simulations and role-based modules, tied together in an annual plan.
Best for
Businesses that must show their safeguards to an insurer, a client or under Québec's Law 25.
Pricing
Sum of the components, budgeted over the year
Strengths
Covers knowledge, practice and measurement
Follows NIST's life cycle approach (SP 800-50 Rev. 1)
Produces the most complete evidence: plan, records, results
Limitations
Needs an owner and a calendar
The most demanding in management time
Behaviour change takes time to show (NCSC)
Everyone agrees employees need training. The disagreement starts when you choose how. An online platform? A workshop in the boardroom? Fake phishing emails? Each format has its fans, and every vendor swears by its own.
The authorities, on the other hand, agree with each other. The Canadian Centre for Cyber Security asks small and medium organizations to invest in security awareness and training for their employees, and recommends building in practical exercises. CISA stresses that training has to be repeated regularly. This comparison helps you put together the right mix for your size and obligations.
Our method
We compare approaches, not vendors. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, NIST, CISA, Québec's CAI and the OQLF, reviewed in October 2026.
Criteria: engagement, measurability, what each format builds, role-based content, cost model, French availability, evidence and management effort.
No prices are quoted: cost models are described qualitatively.
Online training solves a practical problem: reaching everyone, including the evening shift and remote staff. The Canadian Centre for Cyber Security mentions computer-based training as a way for employees to refresh their knowledge, and asks organizations to keep individual training records. A platform produces them automatically.
Its weak spot is engagement. The UK NCSC recommends short, frequent messages and warns against reusing the same training video year after year. There are good free modules, such as the NCSC's Top Tips for Staff, which takes less than 30 minutes, but it's available only in English and Welsh. In Québec, the OQLF reminds employers that training offered to staff must be available in French: check the content, not just the menus.
Nothing beats a trainer showing a real email that accounting received last week. The NCSC recommends tying training to participants' everyday work. A workshop also covers what an online module tends to skip: urgent wire transfers requested by "the CEO," or the embarrassment of reporting a mistake.
Its drawback is that it's a one-off, and people forget. The NCSC finds short, frequent messages more effective than an hour-long session once a year. A workshop is a starting point, or an annual check-in, not a complete program.
Simulations measure what no quiz can: what people actually do with a realistic email. The Canadian Centre for Cyber Security recommends including practical exercises that simulate actual cyber attacks. The tools produce detailed reports: who received the message, who reported it, who clicked or entered credentials, and who completed the assigned training.
The UK NCSC sets two firm limits, though. No training, simulations included, can teach people to spot every phishing attempt. And punishing employees who click erodes trust and discourages reporting. Track the reporting rate first, not just clicks. Our article on phishing simulations for employees explains how to run them without setting traps for your own people.
In SP 800-50 Rev. 1 (September 2024), NIST describes training as a life cycle program, with metrics and evaluation methods to keep improving it. Québec's privacy regulator, the CAI, says much the same in its January 2026 guide: train and raise staff awareness, build an annual action plan, then measure the effect of a phishing awareness campaign.
For a 120-person business, that might look like a baseline module at hiring, a five-minute refresher every month, a simulation every quarter and an annual workshop for finance and leadership. That's also what produces the best evidence: a plan, completion records and simulation results that improve over time. Get Cyber Safe notes that an insurer may ask what security measures you have in place; our guide to cyber insurance questionnaire requirements shows what to prepare.
Role-based modules for finance, leadership and administrators, before they get their access.
Simulations that measure reporting, with no penalties.
Content fully available in French if you operate in Québec.
An up-to-date record: who completed what, and when.
Our ongoing security partner service includes awareness training and phishing simulations, built into your annual plan.
Frequently asked questions
How often should employees get security awareness training?+
Québec's Law 25 doesn't set a frequency. The UK NCSC recommends short, frequent messages rather than an hour-long session once a year, and the Canadian Centre for Cyber Security asks organizations to review their training activities annually. We suggest baseline training for every new hire, before they get access, then a short refresher every month or quarter.
Should employees who click during a simulation be disciplined?+
No. The UK NCSC warns that punishing people for clicking on emails you sent yourself starts to resemble entrapment and discourages reporting. Measure how many people report the message instead, and give a short training module to those who clicked.
Does Law 25 require cybersecurity training?+
The law requires businesses to take reasonable security measures to protect personal information (s. 10). In its guide on preventing confidentiality incidents (January 2026, in French), the CAI lists staff training and awareness among those measures and suggests measuring the effect of a phishing awareness campaign. Check the exact scope of your obligations with your legal counsel.
Is English-only training acceptable for a Québec employer?+
The Office québécois de la langue française states that employers must make the training offered to staff, and the training documents produced for them, available in French, whatever the medium. A platform with only a translated interface may therefore fall short. Check with your legal counsel.