Yes — a failed quiz is not a dead end. The learner keeps the course on their dashboard with its due date, can work through the lesson again and take the quiz until they pass, and the certificate only issues on a pass — so nothing gets recorded as 'complete' until the comprehension check is actually cleared. What a fail does in the meantime is useful: it feeds the learner's Human Risk Score, which is exactly how the next coaching decision gets made.
TL;DR
- Yes — learners can retake a failed quiz: the course stays on their dashboard with its due date until they pass.
- Certificates issue only on pass, and verifiable completion records follow — a failed attempt never counts as a completion.
- A failed quiz or a failed phishing simulation feeds the learner's Human Risk Score, which is how managers spot who needs help.
- Anyone who fails a phishing simulation is auto-enrolled into the failed-phishing course — remediation without an awkward follow-up email.
- Retakes are the point of the model: the published benchmark of phishing susceptibility falling from 33.2% to 4.2% assumes measured, repeated learning, not one-and-done scoring.
Can staff retake a training module after failing a quiz?
| Question | Answer |
|---|---|
| Can the quiz be retaken? | Yes — the course stays assigned on the learner's dashboard until passed |
| Does a fail count as a completion? | No — certificates issue only on pass |
| Where is the fail recorded? | The learner's dashboard and their Human Risk Score |
| What happens after a failed phishing simulation? | Auto-enrolment into the failed-phishing course |
| Does the manager see the fail? | Yes — in reporting, per learner, with the fix attached |
How the retake flow works
A learner watches the story-driven lesson and takes the short quiz that follows it. If they fail, the course stays on their dashboard under its due date — they re-watch the lesson and take the quiz again. The pass is what issues the branded certificate and writes the verifiable completion record; until then, the course sits as outstanding. Learners pick up where they left off on any device, so a retake started on a phone finishes wherever the staff member last had five minutes.
The fail is not hidden while the retake is pending. It lands on the learner's dashboard and in the reporting the manager reads — which is the intended behaviour, not a design flaw. A quiz result that vanishes on retake teaches staff that the score is decoration. Cyber Aware's awareness training tracks quiz results per learner and feeds overdue courses and failed results into each learner's Human Risk Score, so the retake conversation happens on numbers, not vibes.
What a retake costs the programme (almost nothing)
- Learner time: one replay of the lesson and a second pass at the quiz — minutes, not the booking-plus-travel cost of a classroom remediation session.
- Admin time: none. The course stays assigned automatically; nobody re-enrols anyone.
- Reporting impact: the completion date simply lands later, inside the grace window. The programme's completion percentage is unaffected as long as the retake happens before the window closes.
- Evidence quality: improved. A pass recorded after a recorded fail proves the quiz gates anything at all — which is precisely the detail an auditor's spot-check looks for.
The only real cost of a retake is to a completion metric measured on first-attempt pass rates. If a programme's marketing quotes a pass rate, ask whether it is measured on attempts or on learners — the two numbers can differ by double digits, and only the learner-level number tells you anything about comprehension.
Why retakes are the right design
- Comprehension, not attendance. A certificate issued on a failed quiz would be a lie in your evidence trail. Certificates on pass are what makes the completion record worth anything to an auditor, an insurer or an enterprise client.
- The fail is a data point. Repeated fails on the same module flag the learner — or the module — for attention. Either can be the problem, and only a recorded fail can tell you which.
- Phishing remediation already works this way. Anyone who fails a phishing simulation is auto-enrolled into the failed-phishing course automatically. Training that measured a click once and moved on would produce no curve at all.
- The benchmark assumes repetition. KnowBe4's 2026 Phishing by Industry Benchmarking Report measures phishing susceptibility falling from 33.2% to 4.2% over twelve months of sustained monthly training and simulation. A one-shot score cannot produce a twelve-month trend.
What managers should do with the fail data
- Watch the trend, not the first result. A first-attempt fail that clears on retake is normal learning. A learner failing the same module family across three months is a signal — either they need a different format, or the module does not teach what staff actually need.
- Coach on the module, not the person, first. If several learners fail the same quiz, the content is the suspect. Per-learner reporting makes that pattern visible within a month.
- Never punish a failed phishing simulation. Discipline kills reporting culture, and reporting culture is the control that pulls real threats out of the inbox. The published guidance is blunt that reports should be celebrated rather than ignored.
- Keep the evidence. Failed attempts followed by passes are the strongest completion record you can show — they prove the check was real. Cyber Aware's human risk reporting exports those per-learner records for exactly that use.
The wider stakes are worth repeating once: ASD's Annual Cyber Threat Report 2024-25 recorded 84,700 cybercrime reports — one every six minutes — at an average self-reported cost of $56,600 for small businesses, and Verizon's Data Breach Investigations Report again found a human element in roughly 60% of breaches. A programme that let failed quizzes silently count as passes would be measuring nothing.
FAQ
Can staff retake a failed training quiz? Yes. The course stays on their dashboard with its due date, they re-watch the lesson and retake the quiz, and nothing counts as complete until they pass.
Does a failed attempt appear in the reports? Yes — failed quiz results feed the learner's Human Risk Score and the manager's reporting. The fail is a coaching signal, not a blemish to hide.
Do learners get a certificate if they fail the quiz? No. Certificates issue on pass only, which is what makes the completion record verifiable for auditors and insurers.
What happens after someone fails a phishing simulation? They are auto-enrolled into the failed-phishing course — same-day remediation without an awkward follow-up email, and the click feeds their Human Risk Score.
Is there a limit on retakes? The retake loop is built on repetition rather than a strike counter — a learner who fails keeps the course assigned until they pass, and the pattern of repeated fails is what flags them for coaching.
One last thing
The retake question is really a design question: is your training measuring comprehension or collecting attendance? If retakes were impossible, the score would be meaningless. If you are comparing platforms, the comparison page shows how vendors treat failed attempts — and whether their certificates mean what yours need them to mean.