Security awareness training for ASX-listed companies is role-based training for the whole listed workforce: every employee on a monthly core curriculum, with added depth for directors, finance, investor relations and anyone who handles disclosures or payments. It exists because a listed company's cyber exposure is not only operational risk — a material incident is a disclosure event, and disclosure decisions are made by trained people or untrained ones.
TL;DR
- A material cyber incident at a listed company is a disclosure event under ASX Listing Rule 3.1.
- The Security of Critical Infrastructure Act 2018 and the Privacy Act's Notifiable Data Breaches scheme add fixed reporting clocks.
- Verizon's 2025 DBIR puts the human element behind roughly 60% of breaches — the workforce is where a listed entity reduces that share.
- Continuous training moves phishing susceptibility from a 33.2% baseline to 4.2% over 12 months (KnowBe4, 2026 benchmarking report).
- Evidence should come out of the training platform — completion records, simulation results, framework mapping — not from spreadsheets.
Why this matters for listed companies
Three clocks start when a security incident lands at an ASX-listed entity.
Disclosure. ASX Listing Rule 3.1 requires an entity to disclose immediately once it becomes aware of information a reasonable person would expect to have a material effect on the price or value of its securities. A significant intrusion, a ransomware event or a large data exposure can meet that test — and the materiality call is made by directors and executives, not by the security team.
Critical infrastructure reporting. Where the group's operations touch critical infrastructure assets, the Security of Critical Infrastructure Act 2018 applies enhanced cyber obligations, including mandatory incident reporting on tight timelines — 12 hours for an incident with a critical impact on an asset.
Privacy law. The Privacy Act's Notifiable Data Breaches scheme requires a suspected eligible data breach to be assessed within 30 days, with notification to the OAIC and affected individuals as soon as practicable where serious harm is likely. APRA-regulated entities in the group also carry CPS 234 information security obligations, including their own notification requirements.
The trigger behind all three clocks is overwhelmingly a person. Verizon's 2025 DBIR attributes roughly 60% of breaches to the human element, and the Australian Signals Directorate's Annual Cyber Threat Report 2024-25 shows business email compromise leading the self-reported cybercrime categories, at an average cost of $202,691 for a large business. A workforce that does not click is the cheapest control on that register.
Start with a baseline, not a course
Run a phishing simulation across the whole workforce before the first lesson lands. The baseline click rate is the number the board will judge the programme by — without it, a year of training proves nothing.
- Simulate before you train, so the first measurement is honest.
- Break the results down by business unit, not just company-wide.
- Include contractors and subsidiaries in the first campaign.
- Use realistic lures — invoice changes, payroll updates, supplier portals.
The first campaign usually lands between the published benchmark and the worst case. The KnowBe4 2026 industry benchmarking report puts the global baseline at 33.2%, falling to about 4.2% after twelve months of continuous training. That trajectory is the slide the board remembers.
Train monthly, by role
Annual courses do not move click rates. A monthly cadence of short lessons, assigned automatically and reinforced with simulations, is what the benchmark data measures.
- Core curriculum for every employee: phishing, credentials, data handling, incident reporting.
- Finance and payroll get payment-fraud depth: invoice fraud, CEO fraud, call-back verification of bank detail changes.
- Investor relations and disclosure committees get incident-response and disclosure-awareness modules.
- Reminders run on schedule; overdue courses escalate automatically.
Story-driven animated modules with comprehension quizzes hold completion rates up at scale — a 40-minute compliance module assigned once a year does not.
Train the board as participants, not observers
Directors carry the disclosure decisions, so they need their own short modules: what a phishing attempt against a director looks like (gift-card and payment scams target the most senior inboxes first), how incident reporting timelines work, and what evidence the entity will have available when a regulator asks. A board that has personally failed a simulation asks sharper questions about the workforce programme.
Measure human risk, report it upward
A per-learner human risk score turns overdue courses, failed quizzes and phishing clicks into one number the board can track quarter over quarter. At listed-company scale this is the difference between "we do training" and "click rates fell from X% to Y% across business units" — the second is the statement a disclosure committee can stand behind.
- Per-business-unit trend lines, not just a company average.
- Breach monitoring against known data dumps for executive inboxes.
- Exportable evidence for internal audit, insurers and certification bodies.
Map the programme to your frameworks
Internal audit, insurers and certification bodies ask for evidence, not intent. A gap assessment shows where the human layer sits against frameworks such as the Essential 8 and SMB1001, and the training platform generates the completion records that satisfy the audit without a manual evidence hunt.
Options for a listed company at a glance
| Option | Best for | Key limitation |
|---|---|---|
| Cyber Aware | Australian listed companies that need Essential 8 and SMB1001-mapped training, phishing and evidence under one platform | Specialist platform — no bundled email security or backup suite |
| KnowBe4 | Global enterprises that want the deepest content library and benchmark data | Published bands start at 25 seats on 3-year list terms; no public Essential 8 or SMB1001 mapping found |
| Terranova Security | Enterprises wanting benchmarked content in 40+ languages built to WCAG 2.2 AA | Quote-based pricing; no published per-seat rate |
| Huntress SAT | Entities that want a fully managed monthly programme | Tiers start at the 50-99 learner band; co-branding rather than white-label |
Vendor facts come from each vendor's public materials as reviewed in the 2026 buyer's guide, last verified July 2026.
Common mistakes
- Annual-only training. The benchmark reductions all come from continuous cadences, not one course a year.
- Excluding the board. Directors receive targeted phishing and are the least trained population in most programmes.
- No baseline simulation. Without a starting number, no board can be shown progress.
- Evidence kept in spreadsheets. When the OAIC, APRA or an auditor asks, reconstructing completion records from email threads fails.
- Contractors treated as out of scope. Third-party inboxes are inside the attack surface regardless of payroll status.
FAQ
What is security awareness training for ASX-listed companies? Role-based training for the whole listed workforce, with added depth for directors, finance and disclosure roles. It supports continuous-disclosure, critical-infrastructure and privacy obligations, which all run on human error at the trigger point.
Is security awareness training mandatory for ASX-listed companies? No single law mandates it as such, but the obligations it supports are real: critical infrastructure incident reporting, notifiable data breach notification and, for APRA-regulated entities, CPS 234. Boards increasingly treat training evidence as part of those duties.
How often should a listed company train staff? Monthly. The published benchmark falls from 33.2% baseline susceptibility to about 4.2% after 12 months of continuous training and simulation (KnowBe4, 2026) — no annual cadence produces that curve.
Do directors need their own training? Yes. Directors receive spear-phishing, payment fraud and disclosure-adjacent threats directly, and they make the materiality calls a serious incident triggers.
What evidence should the programme produce? Completion records per learner, simulation results over time, framework mapping (Essential 8, SMB1001) and exported reports for auditors, insurers and regulators.
Can contractors be included? Yes, and they should be — any mailbox in the group's domain is part of the attack surface, and per-seat platforms enrol contractors the same as staff.
One last thing
Put the baseline simulation in the board pack the first time you present the programme. A board that sees 33.2% before training and a falling curve after it funds the programme permanently; a board shown only lesson-completion percentages questions why it is paying.