On this page
What should security awareness training cover?
Security awareness training teaches non-technical staff to recognise and avoid common attacks. For most small and mid-sized clients, a programme covers:
- Phishing and social engineering. Spotting suspicious emails, links, attachments, calls and messages, and knowing how to report them.
- Passwords and sign-in. Using a password manager, not reusing passwords, and why multi-factor authentication matters.
- Handling data. Where company files should and shouldn't be stored, sharing safely, and what to do with sensitive information.
- Devices and remote work. Locking screens, public Wi-Fi, lost devices and personal devices.
- Reporting incidents. Who to tell, and how fast, when something looks wrong.
Short modules repeated through the year tend to fit better around work than one long annual session. NIST's guidance on building a cybersecurity and privacy learning program (SP 800-50 Rev. 1) frames training as an ongoing programme aimed at changing behaviour, with metrics to improve it over time.
Ways MSPs deliver training to clients
| Approach | What it looks like | Good for |
|---|---|---|
| Dedicated security awareness platform | A specialist provider runs courses and simulated phishing campaigns | Clients who want phishing tests and detailed risk scoring |
| Course library in the client portal | Staff take courses in the same portal they use for IT help | Keeping training, progress and support in one place |
| Custom courses | The MSP uploads its own videos, documents or packaged courses | Client-specific policies and procedures |
| Live sessions | Workshops for staff or leadership | Launches, new policies, management briefings |
Many MSPs combine these: a specialist provider for phishing simulations, plus a library and custom courses for everything else.
How to roll out training for a client
- Agree the goal with the client. Insurance requirements, customer questionnaires and regulations often drive training. Know which apply so you can produce the right evidence.
- Choose the audience. All staff need the basics. Finance, executives and IT administrators may need extra modules.
- Set a schedule. Enrol users with due dates, and plan reminders rather than chasing people by email.
- Announce it from the client's side. Training lands better when a manager at the client explains why it matters.
- Track completion and follow up. Send reminders to people who are behind, and share progress with the client's managers.
- Repeat. Add new modules through the year and include training in onboarding for new staff. See What should an MSP client onboarding process include?
What to report to clients about training
Client managers usually want to know three things: who has completed their training, who is behind, and, where phishing tests run, how staff responded. Report completion by person and by team, overdue training, and trends over time. Be careful with individual phishing results; agree with the client how they will be used, so training feels like support rather than punishment.
Training results also belong in business reviews and compliance evidence. See What are the best reports for an MSP to send clients?
Training and compliance requirements
Training is increasingly expected, not optional. For example, the EU's NIS2 directive requires members of management at in-scope organisations to follow cybersecurity training, encourages organisations to train staff regularly, and lists basic cyber hygiene and cybersecurity training among its required risk-management measures. See How can MSPs help clients prepare for NIS2? Insurers and customers may ask for completion records too, so keep them easy to export or show.
How MSPortal handles client training
MSPortal includes a Training module inside the client's branded portal, plus a combined view of results from security awareness providers. What is available depends on what the MSP enables and connects:
- Included and premium courses. Standard training is a set of included MSPortal courses at no extra training cost. The optional Bigger Brains Training Library add-on provides 250+ courses, including cybersecurity awareness, Microsoft Office, IT fundamentals and compliance modules. It is billed per client user with Bigger Brains enabled, and you choose which client companies get access. See pricing.
- Your own courses. Create custom courses from a SCORM package, video files or YouTube links, or a document, with optional passing score, maximum attempts, expiry and a mandatory setting.
- Enrolment and learning paths. Enrol users with an optional due date (they get an email), send reminders, and group courses into learning paths assigned to users or groups.
- Progress and certificates. Learners see their own progress and scores. Users with the Manage Training permission see all enrolments and completion reports. Completed courses issue certificates with your branding or the client's.
- Security awareness providers. If you connect Breach Secure Now, Phin, Huntress, CyberHoot or Phished.io, the Security Training view shows learner training status and, where the provider supplies it, phishing results in one table. This data is synced from the provider and read-only; assignments and phishing campaigns are still managed in the provider.
- Reports. Security Awareness Overview and Users Needing Attention blocks can go into client reports.
Client managers with the right permissions can see their staff's status for their own company. The training setup guide and security awareness guide explain each step. Training sits alongside Compliance and the rest of the client portal; to see it, book a demo.
Related questions
How often should client staff take security awareness training?
Regularly through the year rather than once. Short modules every month or quarter, plus training for new starters during onboarding, keep the topics fresh. Match the cadence to any insurance, customer or regulatory requirement the client has.
Should MSPs run phishing simulations for clients?
Phishing simulations show whether training changes behaviour, and many security awareness providers include them. Agree with the client beforehand how results will be used and who sees individual results, so staff see it as practice rather than a trap.
Can clients see their employees' training progress?
They can when the MSP shares it. In a client portal, managers with the right permissions can see who has completed training, who is behind and, if a phishing provider is connected, how staff responded to tests.
Does security awareness training help with compliance?
Often, yes. Regulations such as NIS2, many cyber insurance policies and customer security questionnaires expect staff training and may ask for completion records. Training alone doesn't make an organisation compliant, but the records are useful evidence.