The employee does exactly what was taught in training. He spots a stranger near a restricted department, asks a question, and calls the internal reporting number. No one picks up.
On the training dashboard, his status is likely green. In practice, he is on his own.
Security awareness without practice and testing therefore remains incomplete. Knowledge is necessary, but only a realistic scenario demonstrates whether people can act and whether the organization behind them functions effectively.
You are not testing whether an employee remembered the lesson. You are testing whether the organization enables secure behavior.
Knowing Is Different from Doing
Most employees know the standard rules. Do not open unknown links. Do not allow unauthorized persons inside. Verify suspicious requests. Yet real work is never as straightforward as a training module.
A visitor claims their contact is expecting them. A contractor visits regularly. An executive demands that a payment be executed today. The secure choice takes time, feels impolite, or disrupts the department’s routine.
The NCSC puts it bluntly: knowledge and awareness do not automatically produce behavior. That requires practice, repetition, and testing. Drawing from my facility management background, I recognize above all the gap between policy and daily operations. The procedure is rarely the problem. Tuesday afternoon at 4:30 PM is.
A Test Looks Beyond the Individual
An effective awareness test does not end with the question of whether someone “fell for it.” Suppose a visitor without a badge is stopped. That is a positive outcome. But if reception lacks an up-to-date visitor log, security cannot be reached, and no one knows who makes the call, the security chain remains vulnerable.
A social engineering assessment therefore evaluates four stages: recognize, verify, report, and respond. The critical findings often emerge in the transitions between these stages.
From the Field
At an insurance firm, the receptionist noticed someone waiting unusually long in the entrance lobby. She addressed him, but when he walked in shortly afterward alongside a large group, she did not report it. If he did not belong with that group, surely someone else would have said something.
At a major government agency, a security guard spotted someone taking photos of security cameras. He was alone in the security booth and could not leave his post. The observation never made it into the shift handover log. Only during the debriefing did it become clear that this had been reconnaissance.
This is why a low failure rate means little if only the initial response is measured. A false sense of security can live just as easily in an awareness dashboard as in a camera that no one monitors.
From the Field
Turnover is high among security and reception personnel. What seemed secure during the initial assessment has eroded a year later. Training records will not reveal this; a new operational test will.
Education, Practice, and Testing Each Serve a Distinct Purpose
Training provides knowledge and operational guidance. Practice offers a safe space to deliberately apply those actions. Testing unexpectedly reveals what actually withstands reality.
The sequence does not always have to be rigid. The distinct functions, however, must remain clear. Anyone making mistakes during an announced workshop should be free to learn. Anyone conducting an unannounced test must establish clear boundaries, privacy agreements, and a thorough debriefing in advance.
The NCSC uses the progression of educate, train, exercise, test, evaluate, and learn. Those last two steps are easily forgotten. A test without a debriefing is merely a score. A test that leads to a streamlined reporting workflow, targeted coaching, and a follow-up assessment produces real improvement.
Keeping Testing Safe and Credible
Employees should never be publicly ranked. A test should investigate a relevant risk, not demonstrate a clever trick. Scenarios must remain proportionate and never unnecessarily harm or humiliate anyone.
We therefore prefer to review results as patterns. Which indicators were visible? Where did hesitation occur? Was the secure choice feasible? How did the organization handle the report? Individual feedback can be valuable, but only when delivered carefully and constructively.
Positive behavior also deserves recognition. An employee who courteously escorts a stranger while verifying their identity demonstrates that hospitality and security can integrate seamlessly.
What Should You Measure Instead?
Do not look merely at completion rates and knowledge scores. Focus on operational reality: how often is a relevant threat detected, how effectively is it verified, and how quickly does an actionable report reach the right team? In addition, check whether the same root cause resurfaces during the next test.
Our reports systematically assess:
- what information was publicly accessible;
- whether suspicious behavior was detected;
- whether tailgating was possible;
- whether fraudulent identification was recognized;
- whether entry could be obtained under the pretext of being a vendor;
- whether an alarm was triggered, along with its response time and subsequent handling.
That is the standard baseline. Any further insights uncovered by a test are detailed afterward.
A measurement program does not need to be complex. Select one risk, one desired behavior, and one escalation process. Train for it, test it, and eliminate the friction points. Then repeat with a comparable scenario.
Continuous Security Testing is not an endless series of ambush drills. It is a steady cadence of learning, testing, and improving. E-learning establishes the foundation, a workshop facilitates discussion on tough dilemmas, and coaching reinforces behavior on the floor. Realistic testing demonstrates whether these components drive real change.
When Is Security Awareness Mature?
Not when everyone finishes the module. Nor when a single phishing test produces good numbers. A mature program clearly explains which behavioral risks matter most, what support personnel receive, and what occurs after an incident is reported.
This shifts the core question from “did our staff complete the training?” to “can our people act securely under pressure, and will the organization back them up?”
That is a far more accurate benchmark of resilience.
Want to learn more about integrating learning with testing? Explore security awareness at Cocoon or schedule a consultation.
Frequently Asked Questions
Is a phishing test sufficient?
No. Phishing covers only a single vector. Phone-based social engineering, unauthorized visitors, physical access, and incident escalation require entirely different scenarios.
Should employees know they are being tested?
Not always. An exercise is typically announced; a test may be unannounced. At the organizational level, however, the scope, authority, privacy parameters, and rules of engagement must be clearly established beforehand.
How often should testing occur?
As frequently as risk exposure, organizational changes, and previous results warrant. A recurring schedule provides structure, but opening a new facility, rolling out new procedures, or onboarding a new vendor may trigger an earlier assessment.