Cyber Security Training Services
Choose training by audience and the behavior you want to change. Employees, technical staff, and leaders need different things, and attendance alone doesn't show that anything improved.
On this page
Compare by audience
| Audience | Objective | Sample activity | How to evaluate |
|---|---|---|---|
| Employee awareness | Recognize and report suspicious messages | Short lessons, plus a practice phishing message | Reporting rate and time to report, not only click rate |
| Technical staff | Build job-specific skills | Hands-on lab, such as investigating a simulated alert | Practical assessment; skills used on the job |
| Leadership exercises | Make decisions under pressure | Tabletop: ransomware with a customer deadline | Decisions made, plan gaps found, actions completed |
NIST's SP 800-50 Rev. 1 (September 2024) describes a life-cycle approach to cybersecurity and privacy learning programs, intended for both large and small organizations. For role-based planning, the NICE Framework (SP 800-181 Rev. 1) describes cybersecurity work and skills.
Example: a tabletop exercise
Ninety minutes, seven people
This exercise is invented. A facilitator says: "Files on your shared drive are encrypted, and a customer order is due tomorrow." Leaders decide who speaks to customers, who calls the insurer, and who may approve a shutdown. Then they discover nobody has a printed contact list. That single gap becomes an action item with an owner.
You can run one without a provider: CISA publishes tabletop exercise packages, and NIST's SP 800-84 covers test, training, and exercise programs (published 2006, so use it for structure).
Choosing a format
| Format | Fits when | Watch for |
|---|---|---|
| Self-paced online | Many people, spread out | Completion without any behavior change |
| Live instructor | Questions and context matter | Generic slides not tailored to you |
| Hands-on labs | Technical skills are the goal | Labs unrelated to your systems |
| Tabletop exercise | Decisions and plans need testing | No follow-up on action items |
Our reporting explains why ongoing training beats static policies, and our review of TryHackMe looks at one hands-on option for technical learners. CISA also lists government training resources.
Review what a provider actually delivers
- Who wrote the content, and when was it last updated?
- Can it reflect your tools, industry, and real reporting process?
- What reports will you receive, and do they show behavior rather than only completion?
- How are simulated phishing tests run, and how are people treated when they fail? Punishing staff can discourage reporting.
- For instructors: who teaches, and what is their relevant experience?
- Is a certificate actually needed? If so, confirm that the issuer is the one your employer or customer accepts.
List prices for awareness subscriptions are in the cost guide.
Training is one part of the picture. See how the other services fit together.
Back to the services overview