<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: security-awareness
description: >-
  Security awareness operations including training program design, phishing awareness
  campaigns, security culture metrics, role-based training, social engineering assessments,
  awareness content creation, security champion programs, training effectiveness
  measurement, tabletop exercises, newsletter automation, gamified training platforms,
  and security maturity assessments.
domain: cybersecurity
subdomain: security-awareness
tags:
  - security-awareness
  - training
  - phishing-simulation
  - security-culture
  - social-engineering
  - tabletop-exercises
  - gamification
  - security-champions
  - maturity-assessment
  - compliance-training
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1566", "T1204", "T1598", "T1534", "T1656"]
  nist-csf: ["PR.AT-1", "PR.AT-2", "PR.AT-3", "PR.AT-4", "PR.AT-5"]
  frameworks: ["NIST SP 800-50", "NIST SP 800-16", "CIS Controls v8 14.1-14.9", "ISO 27001 A.7.2.2"]
---

# Security Awareness

## When to Use

Activate when the operator asks about security awareness training, phishing campaigns,
security culture measurement, social engineering assessments, tabletop exercises,
security champion programs, gamified training, or organizational security maturity.

Mode: `[MODE: BLUE]` for training and metrics; `[MODE: RED]` for social engineering assessments; `[MODE: ARCHITECT]` for program design.

## Quick Reference

| Control | Implementation | Priority |
|---------|---------------|----------|
| Security training | Role-based annual + onboarding | 🔴 Critical |
| Phishing simulation | Monthly campaigns with varied pretexts | 🔴 Critical |
| Security champions | Embedded advocates per business unit | 🟡 High |
| Tabletop exercises | Quarterly scenario-based IR drills | 🟡 High |
| Culture metrics | Phish report rate, training completion, survey | 🟡 High |
| Newsletter | Monthly security digest with actionable tips | 🟠 Medium |
| Gamification | Points, badges, leaderboards for secure behavior | 🟠 Medium |
| Maturity assessment | Annual SANS Security Awareness Maturity Model | 🟠 Medium |

## Workflow

### 1. Program Design

```
Security Awareness Program Lifecycle
├── 1. Assessment — baseline metrics, threat landscape, compliance gaps
├── 2. Planning — learning objectives, audience segmentation, content calendar
├── 3. Content — role-based modules, simulations, micro-learning
├── 4. Delivery — LMS, phishing platform, live sessions, newsletters
├── 5. Measurement — KPIs, behavior change, culture surveys
└── 6. Optimization — gap analysis, content refresh, executive reporting
```

### 2. Key Metrics Framework

| Metric | Target | Measurement |
|--------|--------|-------------|
| Phishing click rate | < 5% | Monthly simulation |
| Phishing report rate | > 60% | Report button usage |
| Training completion | > 95% | LMS records |
| Mean time to report | < 10 min | SOC ticket timestamps |
| Security survey score | > 4.0/5.0 | Annual culture survey |
| Incident from human error | < 20% | IR case classification |
| Repeat offender rate | < 3% | Simulation tracking |

### 3. SANS Security Awareness Maturity Model

```
Level 1 — Non-Existent      No program in place
Level 2 — Compliance-Focused Annual checkbox training only
Level 3 — Promoting Awareness Regular content, phishing sims, metrics
Level 4 — Long-Term Behavior Change  Continuous reinforcement, culture shift
Level 5 — Metrics Framework  Data-driven optimization, executive reporting
```

### 4. Role-Based Training Matrix

| Role | Core Topics | Cadence |
|------|------------|---------|
| All employees | Phishing, passwords, physical security, reporting | Annual + quarterly |
| Developers | Secure coding, OWASP Top 10, secrets management | Semi-annual |
| Executives | BEC, whale phishing, board reporting, risk decisions | Quarterly |
| IT/Admins | Privilege escalation, supply chain, IR procedures | Semi-annual |
| HR/Finance | Social engineering, wire fraud, data handling | Quarterly |
| New hires | Full security onboarding module | Day 1 |

### 5. Social Engineering Assessment Types

```
Assessment Vectors
├── Email Phishing — credential harvesting, payload delivery
├── Vishing — voice-based pretexting (helpdesk, IT support)
├── Smishing — SMS-based lure campaigns
├── Physical — tailgating, badge cloning, USB drop
├── Pretexting — scenario-based manipulation
└── OSINT — reconnaissance for targeted attacks
```

## Verification

- [ ] Security awareness program documented and executive-sponsored
- [ ] Role-based training modules deployed to all audience segments
- [ ] Monthly phishing simulations with varied pretexts running
- [ ] Click rate below 5%, report rate above 60%
- [ ] Security champion network active in each business unit
- [ ] Quarterly tabletop exercises with documented lessons learned
- [ ] Culture metrics tracked and reported to leadership quarterly
- [ ] Training content reviewed and updated at least annually
