No — staff cannot complete the training without internet access. Cyber Aware's lessons run in a browser-based portal, so an internet connection is a hard requirement for the training itself, and pretending otherwise would be false advertising. What you can control is how rarely that becomes a problem: short monthly lessons, catch-up windows after each due date, and enrolment methods that reach staff who never had a company email address in the first place.
TL;DR
- The training is browser-based: an internet connection is required to open the portal and watch the lesson — there is no offline download mode.
- Lessons are short story-driven videos, so each attempt needs minutes of connectivity, not an hour-long session.
- Courses carry due dates with reminder and overdue emails, and learners can complete allocated courses within a grace window after the due date.
- Enrolment reaches phone-only staff through CSV upload, not just Microsoft 365 or Google Workspace sync — so connectivity, not email, is the constraint.
- For genuinely air-gapped work, the honest answer is a different control: a documented process briefing with a signed attendance register, not a fake online completion record.
Can staff complete security training without internet access?
| Situation | Can they train? | The honest workaround |
|---|---|---|
| Office with Wi-Fi | Yes — normal browser access | None needed |
| Remote site with patchy mobile data | Yes, in short sittings | One lesson at a time; the portal resumes where they left off |
| Staff sharing a single connection | Yes, staggered | Short lessons keep the queue short |
| Fully air-gapped environment | No | Offline briefing plus a signed attendance register, kept outside the platform |
| No company email address | Yes | CSV upload enrolment — portal access does not depend on email |
Why the platform needs a connection
Every part of the training loop runs online: the learner opens the branded portal, watches the story-driven video, takes the quiz, and the completion is recorded against their dashboard — which feeds the Human Risk Score their manager reports on. Certificates issue on pass and land in the learner's inbox. Each of those steps is a round trip to the platform, because the point of the system is that the completion is real, dated and verifiable — not a checkbox someone ticked offline.
The design trade-off is deliberate. A downloaded PDF of the annual training pack is what an offline-capable system becomes, and the published data is blunt about what that produces: KnowBe4's 2026 Phishing by Industry Benchmarking Report puts phishing susceptibility at 33.2% before training and 4.2% after twelve months of sustained monthly training and simulation. That reduction comes from short, repeated, measured lessons — not from a document handed out at induction. Measuring requires connectivity.
How to make connectivity a non-problem
The requirement is real but small, and it can be scheduled around:
- One lesson at a time. The story-driven video format means a single module needs a few minutes online, not a booked hour. A staff member with patchy mobile data finishes a module between jobs, not in one sitting.
- Grace windows after due dates. Learners can complete allocated courses within a window after the due date, and reminder plus overdue emails chase them — so a site that was offline on the 5th is covered when connectivity returns on the 8th.
- Enrol without email. CSV upload enrols staff who have never had a company mailbox, so the portal link is the only thing they need. Cyber Aware's awareness training supports both Microsoft 365/Google Workspace sync and CSV for exactly this mix.
- Shared-device sites. A single terminal with a browser is enough for a queue of short lessons; the learner's progress is theirs, not the device's.
Planning a programme for mixed-connectivity workforces
Most organisations have a split: connected office staff, semi-connected field staff, and a small air-gapped minority. The mistake is designing the programme around the connected majority and discovering the gap at the first audit. Plan it the other way:
- Count the offline tail first. Pull the workforce list and mark who cannot reliably get online. If it is under 5%, the register-plus-briefing exception below is proportionate; if it is more, the exception is becoming the rule and the programme design needs revisiting.
- Set due dates against connectivity reality. A due date on the day a remote site loses coverage manufactures overdue completions. Dates work when they follow the roster, not the calendar.
- Report the exception honestly. A completion report that silently omits 15% of staff is weaker evidence than one that shows the trained majority plus a dated offline register for the rest.
That last point is the one auditors and insurers actually score: coverage you can explain beats coverage you cannot.
What to do for genuinely offline staff
Some workforces have no reliable connectivity at all — crews on vessels, sites in remote areas, clean rooms. For those, do not fake a platform completion. The defensible approach is the one the government's own framework models: the Australian Signals Directorate's Information Security Manual expects awareness training for all personnel and a maintained training register recording who was trained and when. An offline equivalent — a documented briefing with a signed attendance register, kept with your compliance records — is honest evidence. It is weaker than a trended, per-learner record, and an auditor or insurer will read it that way, so keep the online platform as the backbone for the 95% of staff who can connect and treat the register as the exception.
The stakes for the connected majority stay high either way. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 recorded 84,700 cybercrime reports — one every six minutes — with an average self-reported cost of $56,600 for small businesses, and Verizon's 2025 Data Breach Investigations Report again found a human element in roughly 60% of breaches. The staff member without connectivity is still a person an attacker will eventually reach by phone or in person.
FAQ
Does the security awareness training work offline? No. The portal, lessons and quizzes are browser-based and need an internet connection; completions are recorded online, which is what makes the evidence verifiable.
Can staff train on patchy or metered internet? Yes. Lessons are short story-driven videos, so a single module fits in a few minutes of connectivity, and learners resume where they left off.
How do staff without a company email address get enrolled? Through CSV upload — enrolment does not depend on Microsoft 365 or Google Workspace, so phone-only and contractor staff get their own portal access.
What if a staff member misses a due date because they had no connection? Courses carry a grace window after the due date, and reminder and overdue emails fire on schedule, so the completion can still land inside it.
What is the alternative for fully air-gapped staff? An offline briefing with a signed attendance register, kept in your compliance records — the same pattern the ISM's training register control models. Keep the online platform as the backbone for everyone else.
Can managers see who has not completed because of connectivity? Yes. Outstanding courses with overdue dates appear per learner in the reporting, so a cluster of overdue learners at one site is visible immediately — and distinguishable from individuals who are simply procrastinating.
One last thing
If offline staff are a large share of your workforce, that is a completion-rate risk hiding in your reporting: check what percentage of the workforce never appears in the completion data at all. Cyber Aware's human risk reporting makes that gap visible month by month, and the platform's comparison page shows how vendors differ on enrolment for non-email staff.