# Security Awareness Training: Online, In-Person or Phishing Tests?

Source : https://cybercaribou.com/en/comparisons/security-awareness-training-options · Cyber Caribou

> E-learning platform, in-person workshop, phishing simulations or a combined annual program: engagement, measurement, cost model, French content and evidence.

Everyone agrees employees need training. The disagreement starts when you choose how. An online platform? A workshop in the boardroom? Fake phishing emails? Each format has its fans, and every vendor swears by its own.

The authorities, on the other hand, agree with each other. The Canadian Centre for Cyber Security asks small and medium organizations to invest in security awareness and training for their employees, and recommends building in practical exercises. CISA stresses that training has to be repeated regularly. This comparison helps you put together the right mix for your size and obligations.

- We compare approaches, not vendors. Every value in the table is based on publications from the Canadian Centre for Cyber Security, the UK NCSC, NIST, CISA, Québec's CAI and the OQLF, reviewed in October 2026.
- Criteria: engagement, measurability, what each format builds, role-based content, cost model, French availability, evidence and management effort.
- No prices are quoted: cost models are described qualitatively.
- This comparison is not sponsored.

## E-learning: the baseline you can measure

Online training solves a practical problem: reaching everyone, including the evening shift and remote staff. The Canadian Centre for Cyber Security mentions computer-based training as a way for employees to refresh their knowledge, and asks organizations to keep individual training records. A platform produces them automatically.

Its weak spot is engagement. The UK NCSC recommends short, frequent messages and warns against reusing the same training video year after year. There are good free modules, such as the NCSC's Top Tips for Staff, which takes less than 30 minutes, but it's available only in English and Welsh. In Québec, the OQLF reminds employers that training offered to staff must be available in French: check the content, not just the menus.

## In-person workshops: context and real questions

Nothing beats a trainer showing a real email that accounting received last week. The NCSC recommends tying training to participants' everyday work. A workshop also covers what an online module tends to skip: urgent wire transfers requested by "the CEO," or the embarrassment of reporting a mistake.

Its drawback is that it's a one-off, and people forget. The NCSC finds short, frequent messages more effective than an hour-long session once a year. A workshop is a starting point, or an annual check-in, not a complete program.

## Phishing simulations: a thermometer, not a cure

Simulations measure what no quiz can: what people actually do with a realistic email. The Canadian Centre for Cyber Security recommends including practical exercises that simulate actual cyber attacks. The tools produce detailed reports: who received the message, who reported it, who clicked or entered credentials, and who completed the assigned training.

The UK NCSC sets two firm limits, though. No training, simulations included, can teach people to spot every phishing attempt. And punishing employees who click erodes trust and discourages reporting. Track the reporting rate first, not just clicks. Our article on [phishing simulations for employees](https://cybercaribou.com/en/blog/phishing-simulation-employees) explains how to run them without setting traps for your own people.

## The annual program: what the authorities describe

In SP 800-50 Rev. 1 (September 2024), NIST describes training as a life cycle program, with metrics and evaluation methods to keep improving it. Québec's privacy regulator, the CAI, says much the same in its January 2026 guide: train and raise staff awareness, build an annual action plan, then measure the effect of a phishing awareness campaign.

For a 120-person business, that might look like a baseline module at hiring, a five-minute refresher every month, a simulation every quarter and an annual workshop for finance and leadership. That's also what produces the best evidence: a plan, completion records and simulation results that improve over time. Get Cyber Safe notes that an insurer may ask what security measures you have in place; our guide to [cyber insurance questionnaire requirements](https://cybercaribou.com/en/blog/cyber-insurance-questionnaire-requirements) shows what to prepare.

## How to choose

- [ ] Baseline training for every new hire, as the Canadian Centre for Cyber Security recommends.
- [ ] Short, frequent refreshers with local examples, like those in our guide on [how to spot a phishing email](https://cybercaribou.com/en/blog/how-to-spot-phishing-email-examples).
- [ ] Role-based modules for finance, leadership and administrators, before they get their access.
- [ ] Simulations that measure reporting, with no penalties.
- [ ] Content fully available in French if you operate in Québec.
- [ ] An up-to-date record: who completed what, and when.

Our [ongoing security partner](https://cybercaribou.com/en/services/ongoing-security-partner) service includes awareness training and phishing simulations, built into your annual plan.

## FAQ

**How often should employees get security awareness training?**
Québec's Law 25 doesn't set a frequency. The UK NCSC recommends short, frequent messages rather than an hour-long session once a year, and the Canadian Centre for Cyber Security asks organizations to review their training activities annually. We suggest baseline training for every new hire, before they get access, then a short refresher every month or quarter.

**Should employees who click during a simulation be disciplined?**
No. The UK NCSC warns that punishing people for clicking on emails you sent yourself starts to resemble entrapment and discourages reporting. Measure how many people report the message instead, and give a short training module to those who clicked.

**Does Law 25 require cybersecurity training?**
The law requires businesses to take reasonable security measures to protect personal information (s. 10). In its guide on preventing confidentiality incidents (January 2026, in French), the CAI lists staff training and awareness among those measures and suggests measuring the effect of a phishing awareness campaign. Check the exact scope of your obligations with your legal counsel.

**Is English-only training acceptable for a Québec employer?**
The Office québécois de la langue française states that employers must make the training offered to staff, and the training documents produced for them, available in French, whatever the medium. A platform with only a translated interface may therefore fall short. Check with your legal counsel.

## Sources

- [Canadian Centre for Cyber Security: Offer tailored cyber security training to your employees (ITSAP.10.093)](https://www.cyber.gc.ca/en/guidance/offer-tailored-cyber-security-training-your-employees-itsap10093)
- [Canadian Centre for Cyber Security: Top 10 IT security actions, #6 provide tailored cyber security training (ITSM.10.093)](https://www.cyber.gc.ca/en/guidance/top-10-it-security-actions-6-provide-tailored-cyber-security-training-itsm10093)
- [Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations](https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations)
- [UK NCSC: Phishing attacks, defending your organisation](https://www.ncsc.gov.uk/guidance/phishing)
- [UK NCSC: 10 Steps to Cyber Security, Engagement and training](https://www.ncsc.gov.uk/collection/10-steps/engagement-and-training)
- [UK NCSC: Top Tips for Staff (free e-learning)](https://www.ncsc.gov.uk/information/top-tips-for-staff)
- [NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program (September 2024)](https://csrc.nist.gov/pubs/sp/800/50/r1/final)
- [CISA: #StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide)
- [Commission d'accès à l'information: Prévenir les incidents de confidentialité, guide for businesses (January 2026, in French)](https://www.cai.gouv.qc.ca/uploads/pdfs/CAI_GU_ENTR_Prevention_incidents.pdf)
- [Office québécois de la langue française: training staff in French (in French)](https://www.oqlf.gouv.qc.ca/francisation/entreprises/formation.html)
- [Get Cyber Safe: Does your small business need cyber insurance?](https://www.getcybersafe.gc.ca/en/blogs/does-your-small-business-need-cyber-insurance)
- [Microsoft Learn: Get started using Attack simulation training](https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started)