Cybersecurity e-learning: good for knowing, not for reacting

Cybersecurity e-learning is effective at passing on knowledge: what phishing is, which rules apply, where to report. It is not enough to install a reflex, because a reflex is built by practicing the right reaction in a situation close to the real one. For the phone, you need to add spoken practice and repetition.

This article distinguishes knowing from reflex, explains why modules are forgotten, then proposes a realistic way to combine e-learning and role-play.

What does cybersecurity e-learning do well?

It fulfills three useful functions. It gives all employees a shared vocabulary, it circulates the organization's rules and it leaves a record of delivery. For a large, dispersed population, it is a simple way to start.

It also suits technical or regulatory topics that need to be read: password policy, data classification, use of personal devices. None of this is in question.

The problem starts when you ask it for what it cannot do: turn a known rule into an automatic action, at the moment someone is pressing you on the phone.

Knowing is not reacting: the difference that matters

Knowing means being able to answer a quiz question: “Should you share a code received by text message?” The right answer is obvious, sitting quietly in front of a module.

Reacting means refusing that same code to a friendly voice that announces a fraudulent transfer in progress and asks you to help. The situation adds stress, limited time and a human relationship. The rule is the same, the difficulty is not.

Two elements explain the gap:

• The recall context differs. We retrieve information more easily in a situation that resembles the one where we learned it. A quiz and a phone call have almost nothing in common.
• The sentence has never been spoken. Refusing out loud, without justifying yourself, is a speech act. You do not acquire it by clicking the right answer.

This is also the idea developed in our articles on the limits of the LMS for behavioral skills.

Why we forget: forgetting and spacing

Hermann Ebbinghaus described the forgetting curve as early as 1885: without review, a large share of what we have learned fades quickly. Modules taken once a year and never again are subject to it like everything else.

Research on spaced practice is more encouraging. In their 2006 review in Psychological Bulletin, Cepeda and colleagues show a simple fact. Spreading reviews over time gives better recall results than concentrating them in one session.

Another solid result: testing yourself helps more than rereading. In a study by Roediger and Karpicke (Psychological Science, 2006), students who were mainly tested recalled the content better a week later. The others had mainly reread. Actively recalling fixes better than passively reviewing.

What a reflex really requires

A security reflex rests on three ingredients. The first is a short rule, identical for everyone, such as “I hang up and call back on the official number”. The second is a ready-to-say wording. The third is repetition in varied situations.

Without the second ingredient, the rule stays theoretical. Without the third, it dissolves under stress. The articles in this series detail each action: the callback, refusing under pressure, verifying the caller.

A refusal phrase must be short, polite and without justification. The longer it is, the more the caller finds a hook to press again. “I don't do it by phone, I will call you back” is enough.

The trainer therefore has two tasks: choose the few rules that matter for each job, then have people say the matching phrases until they become natural. Everything else in the program can remain reading material.

How to combine e-learning and spoken practice

The right approach does not set the two against each other. It puts them in order.

1. The module sets the frame: types of attack, rules, reporting channel. Ten to twenty minutes is enough.
2. The role-play provides practice: the learner talks to a persona who pushes, applies the rule and receives a debrief.
3. Spaced repetition maintains it: a short exercise every few weeks, with a different scenario, rather than one big annual appointment.
4. Reporting closes the loop: after each exercise, people practice saying who they report to and what.

This set-up matches what is seen in compliance: the completion rate is not a skill, as our article on compliance e-learning explains.

What can a role-play with an AI persona bring?

A spoken role-play puts the learner in front of an interlocutor who reacts. With Face Up, the trainer writes their scenario from their real cases, for example a fake supplier demanding a bank account change. The learner speaks, the persona pushes, then a debrief indicates the objectives met or not, the strengths, the points to improve and quotes what the learner said.

They can replay straight away. Repetition becomes cheap: no room to book, no actor to mobilize, and everyone practices at their own pace. Integration with the LMS uses LTI 1.3, which keeps the current training path in place.

Imagine two employees after the same module

Two colleagues, Emma and Daniel, finish the same awareness module with a score of 95%. Three weeks later, a caller who says he is a technician from the IT department asks Emma to approve an authentication notification on her phone.

Emma has already spoken, during an exercise, the sentence “I don't approve anything on an incoming call, I will call you back through the official service”. She says it almost without thinking. Daniel knows the rule, but has never had to say it out loud. He hesitates, the caller insists, and he ends up approving to “get it over with”.

Their scores were identical. Their ability to react was not. That is why a quiz pass rate says almost nothing about a team's real protection. For the support case, see social engineering at the help desk.

A grid to audit your current set-up

Review your awareness program with these five questions. They show where practice is missing.

1. Does every important rule have a ready-to-say spoken wording, and not just a written instruction?
2. Have the employees exposed by phone already said that phrase to someone who insisted?
3. Are the refreshers spaced through the year, with different scenarios?
4. Does the feedback given after an exercise quote what the person actually said?
5. Do you measure behaviors (callback offered, code refused, report made) rather than completions?

If three or more answers are negative, add practice before adding modules. One more module lengthens the path without touching the gap between knowing and reacting.

Start small: one job, one scenario, one phrase to anchor. Measure the result over a few weeks, then extend to other teams. This progression, more modest than a big program, leaves time to adjust the scenarios with feedback from the field and to convince managers.

Common mistakes with security e-learning

• Measuring success by completion rate, which only says that the module was opened and finished.
• Offering the same module every year, which breeds fatigue.
• Using technical language with employees who do not need the theory of attacks.
• Neglecting the phone because e-learning mostly deals with email. See the limits of phishing campaigns for voice.
• Making the training punitive: a failed quiz must not turn into a reproach.

Frequently asked questions

Is cybersecurity e-learning useless?

No. It is very good for setting the frame, circulating rules and leaving a record. It is not enough to build a reflex for answering a pressing call.

How often should refreshers happen?

There is no universal frequency. Work on spacing points the same way: several short refreshers are better than one long session. Adapt the rhythm to the job and the exposure.

How do you know whether an employee has a reflex, and not just knowledge?

Look at what they say in a role-play: did they offer to call back, refuse to give a code, note the caller's name? These are observable behaviors, not quiz answers.

Should e-learning be replaced by role-play?

No, it is better to combine them. The module lays the foundation, the role-play provides practice, repetition maintains it. For the overview, see our guide to security awareness training.

Do you want to try a caller-verification role-play with your own cases? Book a Face Up demo.