{"id":13156,"date":"2026-09-01T12:04:06","date_gmt":"2026-09-01T09:04:06","guid":{"rendered":"https:\/\/aboveit.fi\/?p=13156"},"modified":"2026-09-01T13:39:24","modified_gmt":"2026-09-01T10:39:24","slug":"governance-model-keeps-azure-in-check","status":"publish","type":"post","link":"https:\/\/aboveit.fi\/en\/governance-model-keeps-azure-in-check\/","title":{"rendered":"Annual Security Awareness Training Is Not Enough"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Annual security awareness training does not measure or increase an organization’s cyber expertise or resilience, nor does it change ways of working. Instead, security training should be thought of as a continuous and measurable activity across the entire organization. In this blog, we go through the effects of training on organizational security and why we at Above IT chose Moxso as a partner to raise our customers’ security resilience. <\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Attacks Are Evolving Faster Than Ever<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In some organizations, security training still means one thing: in the autumn, a one-hour video is watched, completion is marked, and it is recorded for auditing purposes that the staff has been trained. In March, a near-perfect phishing message arrives, someone logs into the wrong page, and the credentials are in the hands of the attacker. The problem is not that people don’t care. The problem is primarily the lack of training and deficient processes. <\/p>

Easily recognizable phishing messages with typos are a thing of the past. Nowadays, Finnish-language scam messages are linguistically so flawless that you cannot tell it is a scam based on the language alone. <\/p>

Channels have also changed. An attack no longer starts only in email. Phishing has moved to users’ phones, where company protections may not be available. CEO fraud starts with an email and continues with a text message or a phone call aimed at confirming requests. The combination works because each individual event adds credibility when the previous one has already laid the groundwork. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Familiar, more familiar Teams? <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

External Teams communication is open by default. Anyone from another M365 tenant can send a message or call a person. Teams is trusted more than email, and attackers have noticed this too. Training should take different channels into account, rather than focusing solely on scam attempts coming through centralized email. <\/p>

It is also noteworthy that training alone is not enough. Technical security measures must be implemented and developed alongside it, both in Teams and in other areas. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Security Awareness Can and Should Be Measured<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Instead of the same training for everyone, a more effective model starts with a baseline measurement. Simulated phishing messages are sent to the organization’s employees to see what happens. Who clicked, who entered credentials, who reported the message, etc. <\/p>

The results form risk profiles at an individual level. Training is targeted accordingly. A high-risk person receives intensive, repeated exercises on identifying phishing, and those who already know the basics receive more challenging content. Progress is actively monitored. <\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Why We Chose Moxso as a Partner<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We reviewed a number of security training platforms and settled on the Danish company Moxso because it best met our requirements. Their philosophy on security training resonated with us. The platform combines continuous phishing simulations and short training sessions, and it forms individual-level risk profiles that update based on behavior. <\/p>

Moxso’s benefits in a nutshell:<\/p>