[{"data":1,"prerenderedAt":407},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"cmp-\u002Fen\u002Fcomparisons\u002Fsecurity-awareness-training-options":45,"cmp-alt-\u002Fen\u002Fcomparisons\u002Fsecurity-awareness-training-options":392,"cmp-others-\u002Fen\u002Fcomparisons\u002Fsecurity-awareness-training-options":394},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"criteria":209,"date":266,"description":267,"extension":268,"faq":269,"keyword":282,"meta":283,"navigation":146,"options":284,"path":341,"rawbody":342,"seo":343,"sources":344,"stem":377,"translationKey":378,"updated":379,"verdict":380,"verified":390,"__hash__":391},"comparisons_en\u002Fen\u002Fcomparisons\u002Fsecurity-awareness-training-options.md","Security Awareness Training: Online, In-Person or Phishing Tests?",{"type":49,"value":50,"toc":201},"minimark",[51,55,58,79,84,87,90,94,97,100,104,107,116,120,123,131,135,190,197],[52,53,54],"p",{},"Everyone agrees employees need training. The disagreement starts when you choose how. An online platform? A workshop in the boardroom? Fake phishing emails? Each format has its fans, and every vendor swears by its own.",[52,56,57],{},"The authorities, on the other hand, agree with each other. The Canadian Centre for Cyber Security asks small and medium organizations to invest in security awareness and training for their employees, and recommends building in practical exercises. CISA stresses that training has to be repeated regularly. This comparison helps you put together the right mix for your size and obligations.",[59,60,63],"callout",{"title":61,"type":62},"Our method","info",[64,65,66,70,73,76],"ul",{},[67,68,69],"li",{},"We compare approaches, not vendors. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, NIST, CISA, Québec's CAI and the OQLF, reviewed in October 2026.",[67,71,72],{},"Criteria: engagement, measurability, what each format builds, role-based content, cost model, French availability, evidence and management effort.",[67,74,75],{},"No prices are quoted: cost models are described qualitatively.",[67,77,78],{},"This comparison is not sponsored.",[80,81,83],"h2",{"id":82},"e-learning-the-baseline-you-can-measure","E-learning: the baseline you can measure",[52,85,86],{},"Online training solves a practical problem: reaching everyone, including the evening shift and remote staff. The Canadian Centre for Cyber Security mentions computer-based training as a way for employees to refresh their knowledge, and asks organizations to keep individual training records. A platform produces them automatically.",[52,88,89],{},"Its weak spot is engagement. The UK NCSC recommends short, frequent messages and warns against reusing the same training video year after year. There are good free modules, such as the NCSC's Top Tips for Staff, which takes less than 30 minutes, but it's available only in English and Welsh. In Québec, the OQLF reminds employers that training offered to staff must be available in French: check the content, not just the menus.",[80,91,93],{"id":92},"in-person-workshops-context-and-real-questions","In-person workshops: context and real questions",[52,95,96],{},"Nothing beats a trainer showing a real email that accounting received last week. The NCSC recommends tying training to participants' everyday work. A workshop also covers what an online module tends to skip: urgent wire transfers requested by \"the CEO,\" or the embarrassment of reporting a mistake.",[52,98,99],{},"Its drawback is that it's a one-off, and people forget. The NCSC finds short, frequent messages more effective than an hour-long session once a year. A workshop is a starting point, or an annual check-in, not a complete program.",[80,101,103],{"id":102},"phishing-simulations-a-thermometer-not-a-cure","Phishing simulations: a thermometer, not a cure",[52,105,106],{},"Simulations measure what no quiz can: what people actually do with a realistic email. The Canadian Centre for Cyber Security recommends including practical exercises that simulate actual cyber attacks. The tools produce detailed reports: who received the message, who reported it, who clicked or entered credentials, and who completed the assigned training.",[52,108,109,110,115],{},"The UK NCSC sets two firm limits, though. No training, simulations included, can teach people to spot every phishing attempt. And punishing employees who click erodes trust and discourages reporting. Track the reporting rate first, not just clicks. Our article on ",[111,112,114],"a",{"href":113},"\u002Fen\u002Fblog\u002Fphishing-simulation-employees","phishing simulations for employees"," explains how to run them without setting traps for your own people.",[80,117,119],{"id":118},"the-annual-program-what-the-authorities-describe","The annual program: what the authorities describe",[52,121,122],{},"In SP 800-50 Rev. 1 (September 2024), NIST describes training as a life cycle program, with metrics and evaluation methods to keep improving it. Québec's privacy regulator, the CAI, says much the same in its January 2026 guide: train and raise staff awareness, build an annual action plan, then measure the effect of a phishing awareness campaign.",[52,124,125,126,130],{},"For a 120-person business, that might look like a baseline module at hiring, a five-minute refresher every month, a simulation every quarter and an annual workshop for finance and leadership. That's also what produces the best evidence: a plan, completion records and simulation results that improve over time. Get Cyber Safe notes that an insurer may ask what security measures you have in place; our guide to ",[111,127,129],{"href":128},"\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements","cyber insurance questionnaire requirements"," shows what to prepare.",[80,132,134],{"id":133},"how-to-choose","How to choose",[64,136,139,150,162,169,176,183],{"className":137},[138],"contains-task-list",[67,140,143,149],{"className":141},[142],"task-list-item",[144,145],"input",{"disabled":146,"type":147,"aria-label":148},true,"checkbox","Baseline training for every new hire, as the Canadian Centre for Cyber Security recommends."," Baseline training for every new hire, as the Canadian Centre for Cyber Security recommends.",[67,151,153,156,157,161],{"className":152},[142],[144,154],{"disabled":146,"type":147,"aria-label":155},"Short, frequent refreshers with local examples, like those in our guide on how to spot a phishing email."," Short, frequent refreshers with local examples, like those in our guide on ",[111,158,160],{"href":159},"\u002Fen\u002Fblog\u002Fhow-to-spot-phishing-email-examples","how to spot a phishing email",".",[67,163,165,168],{"className":164},[142],[144,166],{"disabled":146,"type":147,"aria-label":167},"Role-based modules for finance, leadership and administrators, before they get their access."," Role-based modules for finance, leadership and administrators, before they get their access.",[67,170,172,175],{"className":171},[142],[144,173],{"disabled":146,"type":147,"aria-label":174},"Simulations that measure reporting, with no penalties."," Simulations that measure reporting, with no penalties.",[67,177,179,182],{"className":178},[142],[144,180],{"disabled":146,"type":147,"aria-label":181},"Content fully available in French if you operate in Québec."," Content fully available in French if you operate in Québec.",[67,184,186,189],{"className":185},[142],[144,187],{"disabled":146,"type":147,"aria-label":188},"An up-to-date record: who completed what, and when."," An up-to-date record: who completed what, and when.",[52,191,192,193,196],{},"Our ",[111,194,195],{"href":25},"ongoing security partner"," service includes awareness training and phishing simulations, built into your annual plan.",[198,199],"cta",{"variant":200},"devis",{"title":202,"searchDepth":11,"depth":15,"links":203},"",[204,205,206,207,208],{"id":82,"depth":11,"text":83},{"id":92,"depth":11,"text":93},{"id":102,"depth":11,"text":103},{"id":118,"depth":11,"text":119},{"id":133,"depth":11,"text":134},[210,217,224,231,238,245,252,259],{"label":211,"values":212},"Employee engagement",[213,214,215,216],"Variable: good if modules are short and refreshed","High during the session","High in the moment; fragile if the approach is punitive","The most sustained: short, frequent messages all year",{"label":218,"values":219},"Measurability",[220,221,222,223],"Completion and quiz scores, per employee","Attendance, unless you add a quiz","Reporting and click rates, per campaign","Completion, reporting and trends year over year",{"label":225,"values":226},"What it builds",[227,228,229,230],"Knowledge","Knowledge and discussion","The reflex in front of a realistic email","Knowledge, reflexes and role-specific responsibilities",{"label":232,"values":233},"Role-based content",[234,235,236,237],"Depends on the platform (role-based paths)","Yes: content tailored to the group","Yes: campaigns by department","Yes: baseline for all, modules by role",{"label":239,"values":240},"Cost model",[241,242,243,244],"Licence or subscription, often per user","Per session, plus staff time","Tool or service, often per user","Sum of the components over the year",{"label":246,"values":247},"French availability",[248,249,250,251],"Variable: check the content, not just the interface","Yes, if the trainer offers it in French","Depends on the tool: check lure emails and training pages","Require it for every component",{"label":253,"values":254},"Evidence for Law 25 and insurers",[255,256,257,258],"Individual training records","Attendance sheets and material presented","Campaign reports: reports, clicks, training completed","Annual plan, records and effectiveness measures",{"label":260,"values":261},"Management effort",[262,263,264,265],"Low: enrol and send reminders","Moderate: schedule and free up staff","Moderate to high: scenarios, setup, follow-up","High: an owner and an annual calendar","2026-10-24","E-learning platform, in-person workshop, phishing simulations or a combined annual program: engagement, measurement, cost model, French content and evidence.","md",[270,273,276,279],{"q":271,"a":272},"How often should employees get security awareness training?","Québec's Law 25 doesn't set a frequency. The UK NCSC recommends short, frequent messages rather than an hour-long session once a year, and the Canadian Centre for Cyber Security asks organizations to review their training activities annually. We suggest baseline training for every new hire, before they get access, then a short refresher every month or quarter.",{"q":274,"a":275},"Should employees who click during a simulation be disciplined?","No. The UK NCSC warns that punishing people for clicking on emails you sent yourself starts to resemble entrapment and discourages reporting. Measure how many people report the message instead, and give a short training module to those who clicked.",{"q":277,"a":278},"Does Law 25 require cybersecurity training?","The law requires businesses to take reasonable security measures to protect personal information (s. 10). In its guide on preventing confidentiality incidents (January 2026, in French), the CAI lists staff training and awareness among those measures and suggests measuring the effect of a phishing awareness campaign. Check the exact scope of your obligations with your legal counsel.",{"q":280,"a":281},"Is English-only training acceptable for a Québec employer?","The Office québécois de la langue française states that employers must make the training offered to staff, and the training documents produced for them, available in French, whatever the medium. A platform with only a translated interface may therefore fall short. Check with your legal counsel.","security awareness training options",{},[285,299,313,327],{"name":286,"url":287,"tagline":288,"pricing":289,"bestFor":290,"pros":291,"cons":295},"E-learning platform","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Foffer-tailored-cyber-security-training-your-employees-itsap10093","On-screen modules that each employee completes at their own pace, with quizzes and completion tracking.","Licence or subscription, often per user; free modules exist, mostly in English (e.g., UK NCSC)","Distributed teams or staggered schedules, and tracking baseline training.",[292,293,294],"Automatic tracking: who finished, with what score","Suits the short, frequent refreshers the UK NCSC recommends","Role-based learning paths, depending on the platform",[296,297,298],"Little room for questions or examples from your day-to-day work","French content must be checked, not just the interface","Wears thin if the same video comes back every year",{"name":300,"url":301,"tagline":302,"pricing":303,"bestFor":304,"pros":305,"cons":309},"In-person workshop","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftop-10-it-security-actions-6-provide-tailored-cyber-security-training-itsm10093","A session led by a trainer, in a room or live online, built around the team's own tools and files.","Per session: trainer's fees plus staff time","Kicking things off, training leadership and finance, or debriefing a recent incident.",[306,307,308],"Examples drawn from the team's everyday work, as the UK NCSC recommends","Employees ask their real questions","Easy to deliver entirely in French or English",[310,311,312],"One-off: the NCSC finds short, frequent messages more effective than an hour once a year","Hard to get everyone in the room, especially evening shifts","Measurement limited to attendance, unless you add a quiz",{"name":314,"url":315,"tagline":316,"pricing":317,"bestFor":318,"pros":319,"cons":323},"Phishing simulations","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fphishing","Fake phishing emails sent to staff to build reflexes and measure who reports, clicks or enters their credentials.","Tool or service, often per user; included in Microsoft Defender for Office 365 Plan 2 and Microsoft 365 E5","Measuring progress and building the reporting reflex, alongside training.",[320,321,322],"Concrete metrics: reports, clicks, credentials entered","A practical exercise, as the Canadian Centre for Cyber Security recommends","Campaigns can target specific departments",[324,325,326],"No simulation can teach people to spot every phish, the NCSC warns","Punishing clicks erodes trust and discourages reporting","Technical setup: sending domains, allow lists, scenarios",{"name":328,"url":329,"tagline":330,"pricing":331,"bestFor":332,"pros":333,"cons":337},"Combined annual program","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F50\u002Fr1\u002Ffinal","Baseline training for everyone, short refreshers all year, simulations and role-based modules, tied together in an annual plan.","Sum of the components, budgeted over the year","Businesses that must show their safeguards to an insurer, a client or under Québec's Law 25.",[334,335,336],"Covers knowledge, practice and measurement","Follows NIST's life cycle approach (SP 800-50 Rev. 1)","Produces the most complete evidence: plan, records, results",[338,339,340],"Needs an owner and a calendar","The most demanding in management time","Behaviour change takes time to show (NCSC)","\u002Fen\u002Fcomparisons\u002Fsecurity-awareness-training-options","---\ntitle: \"Security Awareness Training: Online, In-Person or Phishing Tests?\"\ndescription: \"E-learning platform, in-person workshop, phishing simulations or a combined annual program: engagement, measurement, cost model, French content and evidence.\"\ndate: 2026-10-24\nverified: \"October 2026\"\ntranslationKey: formation\nkeyword: \"security awareness training options\"\noptions:\n  - name: \"E-learning platform\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Foffer-tailored-cyber-security-training-your-employees-itsap10093\"\n    tagline: \"On-screen modules that each employee completes at their own pace, with quizzes and completion tracking.\"\n    pricing: \"Licence or subscription, often per user; free modules exist, mostly in English (e.g., UK NCSC)\"\n    bestFor: \"Distributed teams or staggered schedules, and tracking baseline training.\"\n    pros: [\"Automatic tracking: who finished, with what score\", \"Suits the short, frequent refreshers the UK NCSC recommends\", \"Role-based learning paths, depending on the platform\"]\n    cons: [\"Little room for questions or examples from your day-to-day work\", \"French content must be checked, not just the interface\", \"Wears thin if the same video comes back every year\"]\n  - name: \"In-person workshop\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftop-10-it-security-actions-6-provide-tailored-cyber-security-training-itsm10093\"\n    tagline: \"A session led by a trainer, in a room or live online, built around the team's own tools and files.\"\n    pricing: \"Per session: trainer's fees plus staff time\"\n    bestFor: \"Kicking things off, training leadership and finance, or debriefing a recent incident.\"\n    pros: [\"Examples drawn from the team's everyday work, as the UK NCSC recommends\", \"Employees ask their real questions\", \"Easy to deliver entirely in French or English\"]\n    cons: [\"One-off: the NCSC finds short, frequent messages more effective than an hour once a year\", \"Hard to get everyone in the room, especially evening shifts\", \"Measurement limited to attendance, unless you add a quiz\"]\n  - name: \"Phishing simulations\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fphishing\"\n    tagline: \"Fake phishing emails sent to staff to build reflexes and measure who reports, clicks or enters their credentials.\"\n    pricing: \"Tool or service, often per user; included in Microsoft Defender for Office 365 Plan 2 and Microsoft 365 E5\"\n    bestFor: \"Measuring progress and building the reporting reflex, alongside training.\"\n    pros: [\"Concrete metrics: reports, clicks, credentials entered\", \"A practical exercise, as the Canadian Centre for Cyber Security recommends\", \"Campaigns can target specific departments\"]\n    cons: [\"No simulation can teach people to spot every phish, the NCSC warns\", \"Punishing clicks erodes trust and discourages reporting\", \"Technical setup: sending domains, allow lists, scenarios\"]\n  - name: \"Combined annual program\"\n    url: \"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F50\u002Fr1\u002Ffinal\"\n    tagline: \"Baseline training for everyone, short refreshers all year, simulations and role-based modules, tied together in an annual plan.\"\n    pricing: \"Sum of the components, budgeted over the year\"\n    bestFor: \"Businesses that must show their safeguards to an insurer, a client or under Québec's Law 25.\"\n    pros: [\"Covers knowledge, practice and measurement\", \"Follows NIST's life cycle approach (SP 800-50 Rev. 1)\", \"Produces the most complete evidence: plan, records, results\"]\n    cons: [\"Needs an owner and a calendar\", \"The most demanding in management time\", \"Behaviour change takes time to show (NCSC)\"]\ncriteria:\n  - label: \"Employee engagement\"\n    values: [\"Variable: good if modules are short and refreshed\", \"High during the session\", \"High in the moment; fragile if the approach is punitive\", \"The most sustained: short, frequent messages all year\"]\n  - label: \"Measurability\"\n    values: [\"Completion and quiz scores, per employee\", \"Attendance, unless you add a quiz\", \"Reporting and click rates, per campaign\", \"Completion, reporting and trends year over year\"]\n  - label: \"What it builds\"\n    values: [\"Knowledge\", \"Knowledge and discussion\", \"The reflex in front of a realistic email\", \"Knowledge, reflexes and role-specific responsibilities\"]\n  - label: \"Role-based content\"\n    values: [\"Depends on the platform (role-based paths)\", \"Yes: content tailored to the group\", \"Yes: campaigns by department\", \"Yes: baseline for all, modules by role\"]\n  - label: \"Cost model\"\n    values: [\"Licence or subscription, often per user\", \"Per session, plus staff time\", \"Tool or service, often per user\", \"Sum of the components over the year\"]\n  - label: \"French availability\"\n    values: [\"Variable: check the content, not just the interface\", \"Yes, if the trainer offers it in French\", \"Depends on the tool: check lure emails and training pages\", \"Require it for every component\"]\n  - label: \"Evidence for Law 25 and insurers\"\n    values: [\"Individual training records\", \"Attendance sheets and material presented\", \"Campaign reports: reports, clicks, training completed\", \"Annual plan, records and effectiveness measures\"]\n  - label: \"Management effort\"\n    values: [\"Low: enrol and send reminders\", \"Moderate: schedule and free up staff\", \"Moderate to high: scenarios, setup, follow-up\", \"High: an owner and an annual calendar\"]\nverdict:\n  - profile: \"12-person Québec City firm starting from scratch\"\n    pick: \"In-person workshop\"\n    why: \"A first session built around your own emails and tools creates a shared baseline and gets people talking. Then add short refreshers: one session a year isn't enough.\"\n  - profile: \"60-employee distributor on three sites, with evening shifts\"\n    pick: \"E-learning platform\"\n    why: \"Short modules available at any hour reach every shift, and completion records keep themselves. If you operate in Québec, make sure the content is genuinely available in French.\"\n  - profile: \"120-employee company filling out an insurance questionnaire and documenting Law 25 compliance\"\n    pick: \"Combined annual program\"\n    why: \"Baseline training, refreshers, simulations and modules for leadership and finance, all in an annual plan: that's what produces solid evidence and a measure of effectiveness, as Québec's privacy regulator (CAI) suggests.\"\nfaq:\n  - q: \"How often should employees get security awareness training?\"\n    a: \"Québec's Law 25 doesn't set a frequency. The UK NCSC recommends short, frequent messages rather than an hour-long session once a year, and the Canadian Centre for Cyber Security asks organizations to review their training activities annually. We suggest baseline training for every new hire, before they get access, then a short refresher every month or quarter.\"\n  - q: \"Should employees who click during a simulation be disciplined?\"\n    a: \"No. The UK NCSC warns that punishing people for clicking on emails you sent yourself starts to resemble entrapment and discourages reporting. Measure how many people report the message instead, and give a short training module to those who clicked.\"\n  - q: \"Does Law 25 require cybersecurity training?\"\n    a: \"The law requires businesses to take reasonable security measures to protect personal information (s. 10). In its guide on preventing confidentiality incidents (January 2026, in French), the CAI lists staff training and awareness among those measures and suggests measuring the effect of a phishing awareness campaign. Check the exact scope of your obligations with your legal counsel.\"\n  - q: \"Is English-only training acceptable for a Québec employer?\"\n    a: \"The Office québécois de la langue française states that employers must make the training offered to staff, and the training documents produced for them, available in French, whatever the medium. A platform with only a translated interface may therefore fall short. Check with your legal counsel.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security: Offer tailored cyber security training to your employees (ITSAP.10.093)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Foffer-tailored-cyber-security-training-your-employees-itsap10093\"\n  - title: \"Canadian Centre for Cyber Security: Top 10 IT security actions, #6 provide tailored cyber security training (ITSM.10.093)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Ftop-10-it-security-actions-6-provide-tailored-cyber-security-training-itsm10093\"\n  - title: \"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations\"\n  - title: \"UK NCSC: Phishing attacks, defending your organisation\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fguidance\u002Fphishing\"\n  - title: \"UK NCSC: 10 Steps to Cyber Security, Engagement and training\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002F10-steps\u002Fengagement-and-training\"\n  - title: \"UK NCSC: Top Tips for Staff (free e-learning)\"\n    url: \"https:\u002F\u002Fwww.ncsc.gov.uk\u002Finformation\u002Ftop-tips-for-staff\"\n  - title: \"NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program (September 2024)\"\n    url: \"https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F50\u002Fr1\u002Ffinal\"\n  - title: \"CISA: #StopRansomware Guide\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\u002Fransomware-guide\"\n  - title: \"Commission d'accès à l'information: Prévenir les incidents de confidentialité, guide for businesses (January 2026, in French)\"\n    url: \"https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FCAI_GU_ENTR_Prevention_incidents.pdf\"\n  - title: \"Office québécois de la langue française: training staff in French (in French)\"\n    url: \"https:\u002F\u002Fwww.oqlf.gouv.qc.ca\u002Ffrancisation\u002Fentreprises\u002Fformation.html\"\n  - title: \"Get Cyber Safe: Does your small business need cyber insurance?\"\n    url: \"https:\u002F\u002Fwww.getcybersafe.gc.ca\u002Fen\u002Fblogs\u002Fdoes-your-small-business-need-cyber-insurance\"\n  - title: \"Microsoft Learn: Get started using Attack simulation training\"\n    url: \"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fattack-simulation-training-get-started\"\n---\n\nEveryone agrees employees need training. The disagreement starts when you choose how. An online platform? A workshop in the boardroom? Fake phishing emails? Each format has its fans, and every vendor swears by its own.\n\nThe authorities, on the other hand, agree with each other. The Canadian Centre for Cyber Security asks small and medium organizations to invest in security awareness and training for their employees, and recommends building in practical exercises. CISA stresses that training has to be repeated regularly. This comparison helps you put together the right mix for your size and obligations.\n\n::callout{type=\"info\" title=\"Our method\"}\n- We compare approaches, not vendors. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, NIST, CISA, Québec's CAI and the OQLF, reviewed in October 2026.\n- Criteria: engagement, measurability, what each format builds, role-based content, cost model, French availability, evidence and management effort.\n- No prices are quoted: cost models are described qualitatively.\n- This comparison is not sponsored.\n::\n\n## E-learning: the baseline you can measure\n\nOnline training solves a practical problem: reaching everyone, including the evening shift and remote staff. The Canadian Centre for Cyber Security mentions computer-based training as a way for employees to refresh their knowledge, and asks organizations to keep individual training records. A platform produces them automatically.\n\nIts weak spot is engagement. The UK NCSC recommends short, frequent messages and warns against reusing the same training video year after year. There are good free modules, such as the NCSC's Top Tips for Staff, which takes less than 30 minutes, but it's available only in English and Welsh. In Québec, the OQLF reminds employers that training offered to staff must be available in French: check the content, not just the menus.\n\n## In-person workshops: context and real questions\n\nNothing beats a trainer showing a real email that accounting received last week. The NCSC recommends tying training to participants' everyday work. A workshop also covers what an online module tends to skip: urgent wire transfers requested by \"the CEO,\" or the embarrassment of reporting a mistake.\n\nIts drawback is that it's a one-off, and people forget. The NCSC finds short, frequent messages more effective than an hour-long session once a year. A workshop is a starting point, or an annual check-in, not a complete program.\n\n## Phishing simulations: a thermometer, not a cure\n\nSimulations measure what no quiz can: what people actually do with a realistic email. The Canadian Centre for Cyber Security recommends including practical exercises that simulate actual cyber attacks. The tools produce detailed reports: who received the message, who reported it, who clicked or entered credentials, and who completed the assigned training.\n\nThe UK NCSC sets two firm limits, though. No training, simulations included, can teach people to spot every phishing attempt. And punishing employees who click erodes trust and discourages reporting. Track the reporting rate first, not just clicks. Our article on [phishing simulations for employees](\u002Fen\u002Fblog\u002Fphishing-simulation-employees) explains how to run them without setting traps for your own people.\n\n## The annual program: what the authorities describe\n\nIn SP 800-50 Rev. 1 (September 2024), NIST describes training as a life cycle program, with metrics and evaluation methods to keep improving it. Québec's privacy regulator, the CAI, says much the same in its January 2026 guide: train and raise staff awareness, build an annual action plan, then measure the effect of a phishing awareness campaign.\n\nFor a 120-person business, that might look like a baseline module at hiring, a five-minute refresher every month, a simulation every quarter and an annual workshop for finance and leadership. That's also what produces the best evidence: a plan, completion records and simulation results that improve over time. Get Cyber Safe notes that an insurer may ask what security measures you have in place; our guide to [cyber insurance questionnaire requirements](\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements) shows what to prepare.\n\n## How to choose\n\n- [ ] Baseline training for every new hire, as the Canadian Centre for Cyber Security recommends.\n- [ ] Short, frequent refreshers with local examples, like those in our guide on [how to spot a phishing email](\u002Fen\u002Fblog\u002Fhow-to-spot-phishing-email-examples).\n- [ ] Role-based modules for finance, leadership and administrators, before they get their access.\n- [ ] Simulations that measure reporting, with no penalties.\n- [ ] Content fully available in French if you operate in Québec.\n- [ ] An up-to-date record: who completed what, and when.\n\nOur [ongoing security partner](\u002Fen\u002Fservices\u002Fongoing-security-partner) service includes awareness training and phishing simulations, built into your annual plan.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":267},[345,347,349,352,354,357,360,362,365,368,371,374],{"title":346,"url":287},"Canadian Centre for Cyber Security: Offer tailored cyber security training to your employees (ITSAP.10.093)",{"title":348,"url":301},"Canadian Centre for Cyber Security: Top 10 IT security actions, #6 provide tailored cyber security training (ITSM.10.093)",{"title":350,"url":351},"Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fbaseline-cyber-security-controls-small-and-medium-organizations",{"title":353,"url":315},"UK NCSC: Phishing attacks, defending your organisation",{"title":355,"url":356},"UK NCSC: 10 Steps to Cyber Security, Engagement and training","https:\u002F\u002Fwww.ncsc.gov.uk\u002Fcollection\u002F10-steps\u002Fengagement-and-training",{"title":358,"url":359},"UK NCSC: Top Tips for Staff (free e-learning)","https:\u002F\u002Fwww.ncsc.gov.uk\u002Finformation\u002Ftop-tips-for-staff",{"title":361,"url":329},"NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program (September 2024)",{"title":363,"url":364},"CISA: #StopRansomware Guide","https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware\u002Fransomware-guide",{"title":366,"url":367},"Commission d'accès à l'information: Prévenir les incidents de confidentialité, guide for businesses (January 2026, in French)","https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fuploads\u002Fpdfs\u002FCAI_GU_ENTR_Prevention_incidents.pdf",{"title":369,"url":370},"Office québécois de la langue française: training staff in French (in French)","https:\u002F\u002Fwww.oqlf.gouv.qc.ca\u002Ffrancisation\u002Fentreprises\u002Fformation.html",{"title":372,"url":373},"Get Cyber Safe: Does your small business need cyber insurance?","https:\u002F\u002Fwww.getcybersafe.gc.ca\u002Fen\u002Fblogs\u002Fdoes-your-small-business-need-cyber-insurance",{"title":375,"url":376},"Microsoft Learn: Get started using Attack simulation training","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fattack-simulation-training-get-started","en\u002Fcomparisons\u002Fsecurity-awareness-training-options","formation",null,[381,384,387],{"profile":382,"pick":300,"why":383},"12-person Québec City firm starting from scratch","A first session built around your own emails and tools creates a shared baseline and gets people talking. Then add short refreshers: one session a year isn't enough.",{"profile":385,"pick":286,"why":386},"60-employee distributor on three sites, with evening shifts","Short modules available at any hour reach every shift, and completion records keep themselves. If you operate in Québec, make sure the content is genuinely available in French.",{"profile":388,"pick":328,"why":389},"120-employee company filling out an insurance questionnaire and documenting Law 25 compliance","Baseline training, refreshers, simulations and modules for leadership and finance, all in an annual plan: that's what produces solid evidence and a measure of effectiveness, as Québec's privacy regulator (CAI) suggests.","October 2026","0zCjBsvzKoNBDOmpaIsjw03IZboUM-Att0yb3RCgyYI",{"path":393},"\u002Fcomparatifs\u002Fformation-cybersecurite-employes-options",[395,399,403],{"path":396,"title":397,"description":398},"\u002Fen\u002Fcomparisons\u002Fantivirus-vs-edr-vs-mdr","Antivirus vs EDR vs MDR: Which Endpoint Protection Do You Need?","Antivirus, EDR or MDR? Detection, response, 24\u002F7 monitoring, in-house skills and cost model compared for small businesses with 10, 50 or 150 employees.",{"path":400,"title":401,"description":402},"\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid","Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid","On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.",{"path":404,"title":405,"description":406},"\u002Fen\u002Fcomparisons\u002Fbusiness-password-managers","1Password vs Bitwarden vs Keeper vs Dashlane for Business","1Password, Bitwarden, Keeper or Dashlane? Canadian data hosting, SSO, SCIM, pricing and compliance compared side by side for Canadian small businesses.",1792972906306]