# How We Build a Security Awareness Program: From Threat Mapping to Quarterly Phishing Baselines
Most regulated institutions in the Kingdom purchase a library of security awareness videos, distribute login credentials to staff, and report completion rates to the board. The content is generic, the language often English-only, and the scenarios bear little resemblance to the phishing emails landing in your executives' inboxes or the social engineering tactics targeting your branch staff. Compliance officers tick a box; CISOs watch the same incidents recur.
A security awareness program Saudi regulated institutions can rely on is not a content subscription. It is a structured intervention that begins with your threat landscape, maps to your job roles, delivers in the languages your people speak, and produces quarterly metrics that show whether behavior is changing. This article explains how we build such a program in four phases: threat and role mapping, module design, delivery cadence, and phishing simulation with baseline measurement.
Why generic awareness training produces generic results
The Saudi Central Bank, the National Cybersecurity Authority, and the Capital Market Authority all require that regulated entities train employees on information security. The requirement is clear; the method is not. Many institutions interpret this as annual e-learning, often purchased from international vendors whose scenarios feature Western brand names, regulatory references that do not apply in the Kingdom, and examples of attacks the institution has never seen.
The result is predictable. Employees click through modules to reach the quiz. Phishing simulations run separately, with no connection to the training content. When an executive falls for a credential-harvesting email three weeks after completing the course, the CISO has no data to explain why, and no structured plan to close the gap.
Effective awareness training starts with two questions: what attacks do we actually face, and which roles are most exposed? Until you answer both, you are training everyone on everything, which in practice means training no one on anything that matters.
Phase one: threat and role mapping
We begin every security awareness engagement with a half-day workshop that brings together the CISO, the head of human resources, representatives from compliance, and business-unit leaders who understand how different roles interact with data and systems. The purpose is to map your threat landscape to your organizational structure.
Threat landscape review
We review the past twelve months of security incidents: phishing emails reported by users, malware detections, social engineering attempts at branches or call centers, credential compromise, and any incidents flagged by your security operations center. If you operate a bug bounty or penetration testing program, we examine those findings for patterns in human behavior. If you have suffered a material incident, we dissect the initial access vector.
This review is not theoretical. We are looking for the specific tactics that reach your users: are attackers impersonating your CEO in Arabic or English? Do they reference Saudi regulatory bodies? Are they targeting finance teams with fake invoice emails, or branch managers with requests that bypass approval workflows?
Role segmentation
Next, we segment your workforce by exposure. A branch teller, a treasury analyst, a system administrator, and a call-center agent face different threats and require different training. We document:
- Which roles handle customer data, financial transactions, or privileged access
- Which roles are visible on LinkedIn or the corporate website, making them targets for spear phishing
- Which roles work remotely or travel frequently
- Which roles speak Arabic as a first language, English as a second, or both
The output of this phase is a threat and role matrix: a document that lists your material threats in one column and your role groups in another, with intersections marked where training must be specific. This matrix becomes the blueprint for module design.
At the end of phase one, you hold a written matrix and a shared understanding among stakeholders of why generic content will not address your risk.
Phase two: module design in Arabic and English
With the matrix in hand, we design training modules that are short, scenario-based, and delivered in the language each role group uses daily. We do not purchase off-the-shelf content and rebrand it. We write scenarios that reflect your threat landscape and your operating environment.
Scenario development
Each module opens with a scenario drawn from the threat landscape review. For example:
- A finance officer receives an email in Arabic, appearing to come from the CFO's assistant, requesting an urgent wire transfer to a new vendor account. The email arrives Friday afternoon. What should the officer do?
- A system administrator receives a LinkedIn message from someone claiming to work for a Saudi government entity, asking for a quick call to discuss a security patch. The profile looks legitimate. How should the administrator respond?
- A branch manager receives a call from someone claiming to be from the National Cybersecurity Authority, requesting immediate access to customer records for an audit. What verification steps are required?
Each scenario is followed by a decision tree, an explanation of the correct response, and a reference to your internal policy. Modules run eight to twelve minutes and end with three to five questions that test comprehension, not memory.
Bilingual delivery
We produce each module in Arabic and English. The Arabic version is not a translation; it is written natively, with scenarios that use Saudi business conventions, regulatory references, and the terminology your Arabic-speaking staff encounter daily. The English version serves employees who work primarily in that language, including many technical and risk roles.
Role-specific pathways
We assign modules to role groups. Every employee completes a core set covering phishing, password hygiene, physical security, and data classification. Role-specific modules are added for groups identified in the matrix: finance roles receive modules on business email compromise and invoice fraud; IT roles receive modules on social engineering via technical support channels; customer-facing roles receive modules on vishing and impersonation.
At the end of phase two, you hold a library of scenario-based modules, mapped to roles, available in Arabic and English, and hosted on your learning management system or ours.
Phase three: delivery cadence and reinforcement
Training is not an annual event. Behavior change requires repetition, and threat landscapes shift. We establish a delivery cadence that balances regulatory compliance with practical reinforcement.
Initial rollout
All employees complete their assigned modules within the first sixty days. We provide a communication plan for HR and compliance teams to distribute, including email templates, manager briefings, and escalation steps for non-completion. Completion is tracked by role group, so you can identify pockets of resistance early.
Quarterly micro-learning
Every quarter, we release a new micro-module—three to five minutes—addressing an emerging threat or reinforcing a concept from the initial training. These are triggered by real-world events: if a new phishing campaign targets Saudi institutions, we produce a module within two weeks that explains the tactic and shows employees what to look for.
Manager briefings
We conduct a briefing session for people managers after the initial rollout, explaining what their teams have learned and what behaviors to reinforce. Managers are often the first to observe whether training is changing behavior, and they need language to coach employees without creating fear.
At the end of phase three, you hold a running program with quarterly touchpoints, not a static course catalog.
Phase four: quarterly phishing simulation and baseline metrics
Training without measurement is hope. We run phishing simulations every quarter to establish behavioral baselines and track change over time.
Simulation design
Each quarter, we send a simulated phishing email to a stratified sample of your workforce, ensuring every role group is represented. The email mimics the tactics identified in your threat landscape review: it may impersonate a Saudi regulatory body, a senior executive, a trusted vendor, or a popular service. The email is sent in Arabic or English, depending on the recipient's primary language.
Employees who click the link or download the attachment are redirected to a landing page that explains what happened, why it was a test, and what they should have done. The landing page is not punitive; it is instructional. Employees who report the email using your internal reporting mechanism receive confirmation that they acted correctly.
Baseline metrics and board reporting
We measure three behaviors:
- Click rate: the percentage of recipients who clicked the link or opened the attachment
- Report rate: the percentage who reported the email as suspicious
- Time to report: how quickly users flagged the email after receiving it
These metrics are segmented by role group, department, and language. After four quarters, you have a trend line that shows whether click rates are falling, report rates are rising, and whether specific role groups require additional intervention.
We produce a quarterly report formatted for board and executive committee review. The report includes the simulation scenario, the metrics, a comparison to the previous quarter, and recommendations for the next cycle. This is not a compliance document; it is a risk document that shows whether your human control layer is strengthening or weakening.
At the end of phase four, you hold quarterly metrics, a process for continuous measurement, and a narrative you can present to regulators, auditors, and the board.
What you receive
When we build a security awareness program, you receive:
- A threat and role matrix documenting your material threats and role-group exposures
- A library of scenario-based training modules in Arabic and English, mapped to role groups
- A delivery plan with communication templates, manager briefings, and tracking mechanisms
- Quarterly micro-learning modules addressing emerging threats
- Quarterly phishing simulations with stratified sampling by role and language
- Quarterly metrics reports showing click rate, report rate, and time to report, segmented by role group
- A board-ready narrative that tracks behavioral change over four quarters
You hold a program, not a library. You hold metrics, not completion rates. And you hold a process that adapts as your threat landscape evolves.
Moving from content to culture
A security awareness program that reflects your threat landscape, speaks your employees' language, and produces quarterly behavioral metrics is not a compliance project. It is a risk-reduction project that turns your workforce into a control layer you can measure and improve.
If you are a CISO, HR director, or compliance officer at a Saudi regulated institution tasked with building or improving security culture, and you recognize that generic training is not reducing risk, we can help. Our Security Awareness service is designed to produce the program described in this article: threat-mapped, bilingual, role-specific, and measured quarterly.
