Every new hire in Workday should be inside security awareness training on day one - not whenever an administrator remembers to add them. Connecting Cyber Aware to Workday through Zapier makes that automatic: Workday fires a new-hire event, the learner is created in Cyber Aware with the right group and start date, and the welcome email plus baseline courses are already waiting before the first badge scan.
TL;DR
- Workday has an official Zapier integration with a "new hire created" trigger - no custom webhook build required.
- Cyber Aware connects through Zapier and a direct API, so the Zap maps Workday's new-hire record to a learner enrolment.
- Trigger on the completed hire event, not the draft record - half-finished hires arrive with no working email address.
- Run a second Zap on Workday's employee-terminated trigger so leavers are removed and seat counts stay accurate.
- Test with one real hire before switching the automation on across the tenant.
Why this matters
Manual enrolment fails quietly. Someone forgets, the first reminder lands three weeks late or never, and the newest people in the company - statistically among the most likely to click - spend their first weeks untrained. The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25, an average of one every six minutes (ASD Annual Cyber Threat Report 2024-25). New starters are exactly who invoice-fraud and credential-harvest campaigns target, because they do not yet know what a normal internal request looks like.
Workday is the HR system of record for many Australian mid-market businesses, which makes it the right source of truth for who works here. Cyber Aware's security awareness training already handles what happens after enrolment - monthly courses, due and overdue reminders, remediation on phishing failures - so the only gap is getting each new hire in on time. That is what this connection closes.
Who this is for
- HR and IT teams running Workday as the system of record for employee data.
- MSPs managing client tenants who want training enrolment tied to the client's own HR events rather than a weekly spreadsheet.
- Anyone enrolling by hand today who missed at least one new starter last quarter - that number is the business case.
Before you start
- Workday administrator access. Zapier's own help notes Workday administrator prerequisites for connecting the integration; a regular user account cannot authorise it. Get time with whoever owns your Workday tenant before you start.
- A Cyber Aware account connected to Zapier, or API access if you prefer to build the Workday side as a script.
- A decision on the trigger. Use the event that fires when the hire is complete - the "new hire created" trigger in Workday's Zapier app - not the moment a recruiter saves a draft. A draft record has no confirmed work email, and a learner without an email receives nothing.
- The gotcha: Workday field names differ between tenants depending on how the instance is configured. Never assume the field path for email, name or start date - connect the integration, trigger one real event and inspect the actual payload before you map anything.
Step 1 - Trigger the Zap when Workday creates a new hire
- In Zapier, create a new Zap and choose Workday as the trigger app. The integration's supported triggers are listed on Zapier's Workday page.
- Select the New Hire trigger - it fires when a new hire is created in Workday.
- Connect your Workday account using an administrator-level service user, following Zapier's Workday administrator prerequisites.
- Test the trigger. Workday sends a sample new-hire record; open it and note the exact field names for work email, first name, last name, start date and the organisation or cost-centre field you want to use as a group.
Expected result: a sampled payload with visible, correctly named fields for every value you plan to map.
Step 2 - Enrol the learner in Cyber Aware
- Add Cyber Aware as the action app and choose the action that creates or invites a learner.
- Map the Workday fields to the Cyber Aware learner fields: work email (required), full name and start date.
- Map the Workday organisation field to the matching group in Cyber Aware so reporting lines up with the org chart.
- Test the step with the sampled payload.
Expected result: a test learner appears in Cyber Aware with the right email and group, and the welcome email fires to that address.
Step 3 - Set the training start on day one
- If you want lessons to begin on the start date rather than the enrolment date, set the available-from date on the baseline package to the Workday start date field - not a fixed day.
- Keep the first assignment achievable: a short baseline covering phishing, credentials, data handling and incident reporting, due within the first week.
- Leave deeper role-specific modules for the monthly cadence Cyber Aware already runs.
Step 4 - Handle leavers with a second Zap
- Duplicate the Zap and change the Workday trigger to Employee Terminated - the same app exposes it.
- Change the Cyber Aware action to deactivate the learner.
- Confirm the completion history stays available for the retention period your policy requires; removal from the active learner list is what matters for seat counts and overdue reminders.
Expected result: a leaver disappears from active learner counts the day Workday records the termination, and overdue reminders stop going to people who have left.
Verification and a clean rollout
- Pick the next genuine new hire as your end-to-end test: Workday event, Zapier run, Cyber Aware learner, first lesson delivered.
- For the first month, reconcile weekly: Workday's active headcount against Cyber Aware's active learner count. Every gap needs a named owner.
- Extend the pattern to contractors or contingent workers only after the employee flow runs clean for a full cycle - and decide deliberately whether contingent workers belong in the training cohort.
Troubleshooting
- No Zapier run for a new hire. The Workday integration did not fire - check the service user's permissions and that the trigger is scoped to the right supervisory organisations.
- Learner created with no email. The field mapping pointed at the wrong payload path. Re-sample a real event and fix the mapping; never guess tenant field names.
- Duplicate learners. Two Workday events fired for one hire, or a manual enrolment raced the automation. Turn the manual step off for enrolled starters and keep one trigger per hire.
- Wrong group assigned. The organisation field path changed, or the group name in Cyber Aware does not match the mapped value - fix the mapping or rename the group.
- Leaver still listed as active. The termination Zap is off or filtered; check the trigger fired and the deactivation action ran.
What to do next
Enrolment is the first automated step. Everything after it - monthly courses, reminders, remediation - runs inside security awareness training on a cadence you set once, and the results roll up into human risk reporting as a per-learner score you can hand to a board or an auditor. If you are comparing platforms before committing, the platform comparison shows where vendors differ on exactly this automation.
FAQ
Does Workday have an official Cyber Aware integration?
No - there is no direct Workday connector in Cyber Aware's published integration list, which covers Google Workspace, Microsoft 365, Zapier and a direct API. Workday does have an official Zapier app with a new-hire trigger, so the connection is built as a Zap rather than a native pairing.
Can I skip Zapier and call the Cyber Aware API from Workday?
Yes. Workday's integration tools can call any HTTPS endpoint, so a direct API build works for teams with integration engineers. Zapier simply removes the need to host and maintain that code path yourself.
Which Workday event should trigger enrolment?
The event that fires when the hire record is complete and the work email exists. Triggering on a draft or pre-hire record creates learners who cannot receive anything.
Does this work for contractors and contingent workers?
It works for any worker type Workday emits an event for. Decide deliberately whether contingent workers join the training cohort, then scope the trigger accordingly.
What happens when someone's email changes after enrolment?
The learner is keyed on the original address. Pick a reconciliation rule - for example a monthly report cross-check against Workday - and stick to it.
One last thing
Before you switch the integration on, count how many learners were added manually last quarter and how many starters were missed. That gap is what this connection silently fixes every month from now on.