Nearly 70% of breaches involve human error, according to the Verizon Data Breach Investigations Report. That means your customers’ end users—not firewalls or EDR solutions—are often the weakest link. A single click on a phishing email or an accidental data share can open the door to costly incidents.
For MSPs, security awareness training (SAT) is no longer a nice-to-have—it’s a must-have. The right platform can transform users from liabilities into defenders. But what should you look for? Mike Puglia, GM, Security Products, for Kaseya, shares his guidance.
7 Must-Haves for Your SAT Solution
1. Automate for Consistency
Repetition is what makes training effective. That’s why automation should be at the top of your checklist. Puglia says, “The No. 1 feature to look for in a SAT solution is the ability to automate training campaigns to send on a regular basis. It’s kind of like working out. You don’t build muscle memory by doing the workout once a year or once a quarter.”
2. Keep It Short and Engaging
Users won’t sit through long training sessions. Look for platforms with a large library of bite-sized lessons, Puglia advises. “Two- to 10-minute videos that are fun and entertaining can help build that muscle memory because they see them, they take them, they remember it.”
3. Phishing Simulations Should Be Built-In
Measuring the percentage of users that fall for phishing is a good indicator of a company’s security culture, Puglia says, so look for a program that has built-in phishing simulation. It should also be able to generate reports on which users opened the phishing email, clicked on links, or filled out fake forms. “It’s not about embarrassing someone, but you want to have some way to understand how prevalent it is,” Puglia says.
4. Customize for Relevance and Relationship Building
Off-the-shelf training only goes so far. “Having the ability to customize and send your own messages as part of the training in the platform is important,” Puglia says. It could be as simple as recording a 2-minute video updating your customers on a security incident they may be hearing about in the news.” Taking a few minutes every month to create a custom video, he adds, “puts a face to the MSP.”
5. Prioritize Integrations
Efficiency matters. Puglia cautions, “It’s important that a SAT solution integrates with your email security product so that your phishing simulations don’t get blocked. You don’t want to spend a lot of time disabling features so you can run your training campaigns.” Integrations with your IT documentation, PSA, and compliance platform are also important, he says.
6. Make Sure It’s Affordable
SAT should strengthen margins, not strain them. Puglia advises choosing a training program that is priced so that you can provide it to all your end users. “Our Bullfish ID solution is included in Kaseya 365 User, and it works out to pennies a user, versus programs that can range up to $3 per user per month that are hard to absorb.”
7. Demand Onboarding and Support
Don’t overlook onboarding. Puglia stresses, “If you buy a product and try to figure it out on your own, you know there are going to be things that you miss, no matter how many pop-ups try to guide you.”
The Bottom Line
The right security awareness training platform makes training stick without overwhelming your techs–or your clients. Puglia also encourages MSPs to make end user security training part of your standard security bundle.
By choosing a solution that automates, engages, integrates, and scales, MSPs can turn security awareness from a checkbox into a competitive advantage.
