Choosing security awareness training topics is easier when you plan a full year at once. One short lesson a month keeps the subject alive without pulling staff off their work, and a fixed calendar means you never have to decide what to teach next. This guide sets out a 12-month curriculum, why each topic is there and how to measure whether it works.
TL;DR
- Monthly micro-lessons outperform one long annual session for building habits.
- Start with phishing and passwords, then layer in data handling, payment fraud, remote work and AI-enabled scams.
- Pair every topic with a quiz and, where possible, a matching phishing simulation.
- Review the calendar each year and swap topics for threats your team actually met.
- Keep records of completions for insurers, auditors and clients.
Why plan a calendar
The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25 (ASD Annual Cyber Threat Report 2024-25). Threats change, but the behaviours that stop most of them are stable: pause, verify, report. A calendar repeats those behaviours through different scenarios so they become reflexes rather than reminders.
The 12-month curriculum
| Month | Topic | Behaviour to build |
|---|---|---|
| 1 | Phishing basics | Check sender and link before clicking |
| 2 | Passwords and multi-factor sign-in | Unique passwords; approve only prompts you started |
| 3 | Invoice and payment fraud | Verify bank-detail changes by phone |
| 4 | Data handling and privacy | Share the minimum, with the right people |
| 5 | Smishing and voice scams | Do not act on unexpected texts or calls |
| 6 | Remote work and public Wi-Fi | Secure home networks and devices |
| 7 | Social engineering and impersonation | Question urgent requests from authority |
| 8 | Reporting incidents | Report quickly without fear of blame |
| 9 | AI-enabled scams and deepfakes | Verify unusual requests through a second channel |
| 10 | Physical security and devices | Lock screens; protect laptops and USB drives |
| 11 | Breaches and what leaked data means | Change passwords after a breach alert |
| 12 | Review and quiz-off | Reinforce the year with a team challenge |
How to run each month
- Assign the lesson on the first of the month with a due date and automatic reminders.
- Follow it with a quiz to confirm understanding rather than attendance.
- Match a simulation to the topic. Month 3 pairs with an invoice-fraud simulation; month 1 with a credential lure. Cyber Aware's phishing simulations library covers both.
- Auto-enrol clickers into a short follow-up lesson.
- Report results monthly. Human risk reporting shows completion, engagement and a risk score per person.
Cyber Aware's security awareness training library of story-driven lessons can be scheduled to add a new course each month automatically, so the calendar runs without manual effort.
Tailoring the topics
Swap in what your team actually faces. A finance team may want an extra payment-fraud month; a healthcare team may want a privacy month; a remote team may want more on device security. Starting with a gap assessment shows which topics deserve more weight.
Measuring success
Watch three numbers: completion rate above 90 percent, a rising report rate for suspicious email and a falling click rate on simulations. If one stalls, change the format, not just the reminder.
FAQ
How long should each monthly lesson be? Five to ten minutes is enough when it is story-based and followed by a quiz.
What topics should come first? Phishing and passwords, because they address the most common ways in.
Do we need to cover every topic every year? No. Repeat the core behaviours and rotate the rest based on what your team has met.
How do we prove we ran the programme? Export completion and quiz records each month and keep them with your compliance documents.
One last thing
Write the 12 topics into a calendar today and assign month one. Momentum matters more than perfection.