Awareness training is not incident response training: a note for Cybersecurity Awareness Month

It is October, which means Cybersecurity Awareness Month. Posters go up, phishing simulations go out, and security teams report training completion rates to the board. All of that has value. This note is a reminder of what it does not cover.

What is on offer this month?

KnowBe4 announced on 11 August 2026 a free Cybersecurity Awareness Month kit for October: posters and signage in multiple languages, four tabletop exercise documents, training videos and modules, planning resources and webinars, organised around four weekly themes. KnowBe4 sells security awareness training and simulated phishing year-round, with 1,000+ modules, videos and games, and states it has 70,000+ customers. Unusually for this category, it publishes US list prices: from $1.63 to $3.75 per seat per month on a 3-year term, depending on tier and seat count.

Free material like this makes October the cheapest month of the year to run a workforce campaign.

What does awareness training do well?

It reaches everyone. Awareness training is the only one of the four training types built for the whole workforce, and its subject, recognising and reporting phishing and other everyday threats, is a real part of the attack surface. Simulated phishing gives a measurable result that can be tracked over time.

What does it not do?

It does not prepare the people who run an incident. When an attack gets through, and some will, the response depends on a much smaller group: analysts, the incident commander, IT, legal, communications and the executives who make the calls. Awareness modules do not train that group to detect, contain, decide or disclose.

This matters because the two are easy to confuse in reporting. A board told that 95% of staff completed security training may assume the organisation is ready for an incident. It may not be.

How should the two sit together?

Treat them as separate lines in the plan:

• Workforce: awareness modules and simulated phishing, with October as a peak and smaller campaigns through the year.
• Response team: hands-on labs and a cyber range for technical staff; tabletop or crisis simulation for decision-makers.

Some crisis platforms reach beyond the core team. iluminr, for example, describes short individual microsimulations and benchmarking by department, region and role. That widens who practises decisions, but it is not phishing training, and none of the crisis platforms on this site describes phishing simulation.

What about the four tabletop documents in the kit?

They are a useful bridge. A free tabletop document can start a conversation with the leadership team during awareness month, when security has their attention. Treat it as a first step, not a programme: CISA's free packages, over 100 of them, go further, with scenarios, discussion questions and an after-action report template. A platform goes further again, with less preparation and more realism.

Why does this distinction matter to regulators and boards?

Because the questions they ask are different. Awareness records show staff are trained. Exercise records show the incident response process has been used. For US public companies, Regulation S-K Item 106, adopted by the SEC on 26 July 2023, asks for an annual description of cybersecurity risk management processes and board oversight; workforce training is part of that picture, but so is evidence that the response process works.

What is a good use of October?

Run the awareness campaign, and use the attention it brings to book the year's response exercise. Put a date in the calendar for a tabletop or crisis simulation with the people who would run a real incident, and make the after-action report part of next year's awareness month report to the board.

How do you report the two to the board?

Separately, and in plain terms. One line for the workforce: completion and phishing results, and how they moved. One line for the response team: which exercises ran, what they found, and which fixes are done. Putting the two side by side stops a high completion rate from standing in for readiness it does not measure.

The awareness training guide explains where awareness training stops and which platforms here sell it.