Security Awareness, Training, and Phishing Metrics

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Security Awareness, Training, and Phishing Metrics

Key Takeaways Explain This Topic AI

Awareness keeps security visible, training teaches required skills, and exercises measure whether behavior actually improves.

Role-based training matches content to job risk: developers learn secure coding, finance learns payment-fraud verification, executives learn impersonation defense.

Phishing simulations measure behavior and reporting, not just click rate; a low click rate alone is an incomplete picture.

Useful metrics include click rate, credential-submission rate, report rate, time to report, repeat-offender rate, and department trends.

A blameless reporting culture speeds detection; punishing mistakes drives users to hide them and slows incident response.

Last updated: June 2026

Awareness, Training, and Exercises

People approve payments, handle customer data, write code, reset passwords, and respond to suspicious messages — so SY0-701 treats the workforce as a control surface. Three terms are distinct on the exam:

Awareness keeps security visible and understandable (a monthly reminder).

Training teaches a specific required skill or procedure (help-desk identity verification).

Exercises/simulations practice and measure response (a phishing campaign with reporting metrics).

• Activity Purpose Example
• Awareness Keep security top of mind Reminder to report suspicious messages
• Training Teach required knowledge Identity-verification procedure
• Role-based training Match content to job risk Developers learn secure coding; finance learns payment fraud
• Simulation Practice and measure Phishing exercise with report-button metrics

Generic annual training is not enough for every role. Developers need secure coding and dependency handling; administrators need privileged-access and change-control training; executives need travel, impersonation, and sensitive-communication guidance; finance needs invoice-fraud and payment-change verification. The exam frames this as role-based or targeted training, and the correct answer to "users in role X keep falling for attack Y" is almost always training matched to that role's risk , not a broader generic course or a punitive measure.

Program development and execution is also testable. A mature awareness program runs on a defined cycle: it sets objectives, delivers content during onboarding and on a recurring schedule (often annually with monthly reinforcement), runs simulations, measures results, and feeds those results back into the next cycle of content. New hires receive training before or immediately upon receiving access, and contractors and temporary workers are explicitly included — a frequent gap.

Compliance-driven training (PCI DSS, HIPAA, GDPR awareness) is tracked for completion because regulators may ask for records, but completion alone never proves behavior changed.

Recognizing the Threats

Awareness programs teach users to recognize social engineering principles attackers exploit — authority, urgency, scarcity, intimidation, familiarity/liking, consensus, and trust — and the channels they arrive through: phishing (email), smishing (SMS), vishing (voice), whaling (targeting executives), and business email compromise (BEC) . Users also learn to flag anomalous behavior : unexpected wire requests, after-hours logins, a colleague suddenly asking for credentials, or risky use of removable media found in a parking lot.

SY0-701 ties these to user guidance and policy topics — situational awareness, insider-threat reporting, operational security (OPSEC), and how to handle hybrid or remote-work risk on untrusted networks. The recurring lesson is that the human is both the most-targeted attack surface and, when trained to report, the fastest sensor an organization owns.

Phishing Metrics

• Metric What it shows Program use
• Click rate Who clicked the link Spot risky patterns — never use alone
• Credential-submission rate Who entered data Measures higher-risk behavior
• Report rate Who reported the message Reward and reinforce desired behavior
• Time to report How fast users alert security Improves containment speed
• Repeat-offender rate Users repeatedly at risk Target coaching
• Department trend Patterns by business area Tune role-based scenarios

A low click rate is good but incomplete. A mature program also wants a high report rate and a fast time to report , because rapid reporting shrinks the attacker's dwell time. If users fear punishment, they hide mistakes — which slows incident response. This is why a blameless reporting culture is the goal. Track trend over time rather than a single snapshot: a one-off click rate says little, but a steadily falling click rate and a steadily rising report rate across quarters demonstrate the program is working.

Watch the repeat-offender rate to identify the small group of users who need one-on-one coaching, and segment by department so finance, engineering, and the executive suite each get scenarios matched to how attackers actually target them. Finally, the realism of the simulation must respect policy and dignity — a lure promising fake bonuses or fake layoffs can backfire, erode trust, and depress reporting, which defeats the program's purpose.

Scenario

Finance receives a simulated email claiming a supplier changed bank accounts; it uses a lookalike domain and demands urgent payment redirection. Results: 10% click, 2% submit credentials, and 65% report within 20 minutes.

A mature team does more than announce the click rate. It compares results to the prior exercise (trend), checks whether the payment-verification procedure was followed, thanks fast reporters, and gives targeted training to the credential-submitters. The finance process is then hardened so any bank-detail change requires an out-of-band callback to a known contact — the control that actually stops BEC.

Common Awareness Topics and Traps

Core topics: phishing/smishing/vishing/BEC; password managers and MFA fatigue/prompt-bombing; data classification and handling; clean desk and screen locking; removable-media risk; secure remote work and public Wi-Fi; incident reporting; tailgating and piggybacking; role-specific fraud workflows.

Measuring only training completion , not behavior.

Punishing users so they stop reporting.

Sending simulations that violate policy or cause real harm.

Using one generic course for every role.

Skipping new hires, contractors, and privileged users.

Ignoring positive metrics such as rapid reporting.