Yes — staff complete security awareness training on their phones. Cyber Aware's lessons run in the browser every modern phone already has, so nobody has to download anything from an app store, and the story-driven video format is short enough that a full module fits into a commute or a smoke break. The honest nuance: on phones the training itself works perfectly, while a couple of supporting actions — reporting suspicious email, in particular — are stronger on desktop.
TL;DR
- The training is browser-based: staff open the portal on any phone and watch the lesson, no app install required.
- Lessons are short story-driven videos with a quiz after each, built to be finished on a phone in a spare five minutes.
- Certificates, dashboards and leaderboards all work on mobile, so completion evidence is the same wherever the staff member learns.
- Phishing simulations are best opened on a desktop, where the Outlook and Gmail report buttons live — but the lesson after a click works on mobile too.
- Cadence is what changes behaviour: the published benchmark of phishing susceptibility falling from 33.2% to 4.2% needs monthly lessons, and mobile access is what keeps that cadence possible for front-line and remote staff.
Can staff complete security awareness training on a mobile app?
| Mobile question | How it works |
|---|---|
| Install required? | No — the portal runs in the phone's browser |
| Lesson format | Short story-driven video, then a quiz |
| Where progress is tracked | The learner's dashboard, same record on any device |
| Certificates | Issued on pass, QR-verifiable, work on mobile |
| Best device for phishing reports | Desktop, where the Outlook and Gmail report buttons sit |
| Enrolment | Automatic from Microsoft 365 or Google Workspace sync, or CSV upload |
What mobile completion looks like in practice
A staff member gets a reminder email, taps it on their phone, and lands in the branded portal. The month's course is on their dashboard with its due date. The lesson is a story-driven video — a dramatised real-world incident rather than a slideshow — followed by a short quiz that confirms they understood it. On pass, the certificate issues automatically. The whole loop fits in a coffee break, and the completion lands in the same records their manager reports on.
That loop matters more than the device it runs on. Training changes behaviour through repetition at a steady monthly cadence, not through one long annual session. KnowBe4's 2026 Phishing by Industry Benchmarking Report puts phishing susceptibility at 33.2% before training and 4.2% after twelve months of sustained monthly training and simulation — a reduction that is only achievable if every staff member can actually complete a lesson every month. For desk staff, that is easy. For delivery drivers, nurses, retail staff and field technicians, it only works if the lesson comes to the device they actually carry.
Why the mobile question decides your completion rate
- Frontline staff have no desk. If the only way to train is a desktop in head office, your warehouse, clinic and field teams never appear in the completion report — and they are exactly the people who answer unexpected texts and calls.
- Spare minutes are on the phone. Five minutes waiting for a job to load is a finished module. Twenty minutes booked in a meeting room is a no-show.
- Reminders reach the phone. Due and overdue reminder emails land where staff actually look, and one tap opens the lesson.
- Progress is visible either way. The learner dashboard shows assigned courses, due dates and personal results, and the same data feeds the manager's reporting — so mobile completions count exactly like desktop ones.
What to check before promising mobile training
- Does it need an install? A browser-based portal beats an app: no app-store approval for corporate phones, no mobile-device-management friction, works on personal devices too.
- Is the content short-form? Long desktop-era modules die on a phone. Story-driven videos a few minutes long are what actually get finished on the bus.
- Do quizzes and certificates follow on mobile? If the certificate only issues on desktop, half your evidence trail has a hole.
- Does enrolment reach everyone? Auto enrolment from Microsoft 365 or Google Workspace covers office staff; CSV upload covers contractors and phone-only staff who never had a company mailbox.
- Is the portal branded? On a personal phone, a portal with your company's branding is what convinces staff the message is legitimate — a generic third-party login is what convinces them it is phishing.
Where phones are not the right tool
Mobile training has one honest gap: reporting real suspicious email. The report buttons live as add-ins in Outlook and Gmail, which staff mostly use on desktop — and a reported email is the most valuable event in the whole programme, because every report pulls a threat out of the inbox before a colleague clicks it. Phishing simulations themselves can be opened on any device, and the branded explainer plus the follow-up course a click triggers work fine on mobile. But treat desktop email habits as the reporting habit, and schedule the training to match where staff actually read their mail.
The stakes for getting this right are not abstract. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded 84,700 cybercrime reports — one every six minutes — with an average self-reported cost of $56,600 for small businesses. Verizon's Data Breach Investigations Report found a human element in roughly 60% of breaches. The staff member who never sits at a desk is still a person an attacker will text, call or email.
FAQ
Do staff need to install an app to do the training? No. The portal runs in the phone's browser — they tap the reminder, sign in, watch the lesson and take the quiz. Nothing to download or approve.
Can staff do the training without a work email address? Yes. Enrolment can run from Microsoft 365 or Google Workspace sync for staff with company mailboxes, and CSV upload covers contractors and phone-only staff — they get their own portal access.
Do mobile completions count in the reporting? They count identically. Completions, quiz results and certificates record per learner and feed the Human Risk Score, no matter which device the lesson was finished on.
Can staff take a phishing simulation on their phone? Yes — the simulation email opens anywhere. Just remember the report button lives in desktop Outlook and Gmail, so reporting behaviour is best trained where staff read email most.
Will the training work on an old or basic phone? Any phone with a modern browser handles the video lessons. If a device genuinely cannot, CSV enrolment and scheduled catch-up sessions cover the exceptions.
One last thing
The mobile question is really a completion-rate question. Before you pick any platform, ask to see the completion percentage for frontline customers, not office customers — Cyber Aware's end user portal is built around short monthly lessons precisely because the published 33.2% to 4.2% benchmark only exists on a cadence every member of staff can keep.