Most security awareness programs measure one thing: did the person click through the video?
That's what gets reported. "98% completion." It looks great on a slide. It says almost nothing about whether anyone learned to spot a phishing email or knows who to call when they do.
Auditors know this. More of them are asking a harder question: how do you know the training worked?
Completion is the floor
Completion still matters. Frameworks such as SOC 2 and ISO 27001 expect you to show that people were trained. But "assigned and opened" is the weakest form of that evidence.
A passed assessment is stronger. It shows the person engaged with the material well enough to answer questions about it, and it gives you a record you can point to.
What changed in Safeguard
Training assignments in Safeguard can now require a passed assessment before they count as complete. Watching isn't enough. The person has to pass.
The people register around it got more precise too:
- Worker types, so employees, contractors and other groups can be handled differently.
- Excluded accounts, for service accounts and shared mailboxes that shouldn't show up as untrained humans and drag your numbers down.
- Background check records, kept next to the person they belong to, which is where an auditor will look for them.
Making assessments worth taking
Requiring a pass only helps if the questions are good. A few rules that keep assessments honest:
- Ask about decisions, not definitions. "What do you do with this email?" beats "What is phishing?"
- Use your own examples. A fake invoice from your real finance tool teaches more than a generic one.
- Keep it short. Five good questions beat twenty easy ones.
- Retest what people get wrong. If half the company misses the same question, that's the training topic for next quarter.
The payoff
When the auditor asks how you know training worked, you can show who was assigned, who passed, when, and which roles are excluded and why. One export, no spreadsheet stitching.
And more usefully, you'll know which lessons didn't land before an attacker finds out for you.
Try it yourself
Click through it at your own pace, or open it full screen.
Try these three sample assessment questions on yourself. Then use the same style for your own team.
Quick check
1. An email from your CEO asks you to buy gift cards urgently and keep it quiet. What do you do?
Don't reply or buy anything. Verify through a different channel, such as a call or chat you start yourself, and report the email to security.
2. A shared document link asks you to sign in again with your work password. What do you check first?
The domain in the address bar. If it isn't your real sign-in page, close it and report it.
3. You think you clicked a bad link. Who do you tell, and how fast?
Your security contact, right away. Early reports limit the damage, and nobody gets in trouble for reporting.
