Security awareness event or platform: Which format suits which goal?

A security awareness event can bring many people together in a short time. A platform can distribute and repeat measures over an extended period. This comparison quickly gives rise to a false dichotomy: which format is fundamentally better?

For CISOs and awareness managers, a different question is more helpful. Which operating model supports the specific security goal, the available internal resources, and the desired cadence? A compelling format achieves little if afterwards no one prioritizes topics, contextualizes results, or takes responsibility for follow-up actions.

The operating model is key

ENISA treats awareness not as a one-off training session, but as a program. The agency links target groups, suitable tools and channels, communication strategies, and key performance indicators for evaluation. This shifts the selection decision away from mere form toward organizational integration.

The UK NCSC's Cyber Assessment Framework also emphasizes that awareness and training should be tailored to roles and actual working methods. It mentions ongoing reminders and refreshers as well as varied delivery methods. At the same time, the framework cautions against expecting a long-term security culture from a single training event.

An event and a platform therefore address different operational tasks. An event bundles attention, facilitation, and exchange at a scheduled time. A platform supports a distributed program that managers organize themselves across target groups and timeframes. Both can be valuable. What matters is whether the organization can realistically operate the respective model.

Five questions before choosing a format

Before comparing vendors or budgets, those responsible should clarify five points in writing:

1. Which security goal takes priority? Is it about a visible kick-off, team discussion, recurring engagement with multiple topics, or documented participation?

2. Which target groups need to be reached, and when? A shared appointment requires scheduling coordination. A distributed format, on the other hand, demands reliable assignment, communication, and tracking.

3. Who will run the operations? Planning, internal communication, topic selection, execution, queries, and evaluation require designated owners.

4. What evaluation is needed for the next decision? Participation rates and game scores can provide clues. On their own, they prove neither safe day-to-day behavior nor a reduction in corporate risk.

5. What happens after the measure? Insights must feed into further communication, training priorities, or the review of technical and organizational controls.

These questions prevent an engaging event from ending without follow-up, or a platform from being procured when internal time, ownership, and editorial pacing are lacking.

When a facilitated awareness event fits

An event is especially suitable when the organization has a clearly defined occasion and a mandatory shared time. This could be a kick-off for an awareness program, a cybersecurity action day, or the collective exploration of a prioritized topic area. The format's value lies in temporal consolidation: invitations, facilitation, and exchange are organized as a single visible session.

To decide, however, the CISO should look more closely at the prerequisites. Which target group should participate? What message should be carried forward into the company after the session? Who gathers questions and feedback from the event? And which team decides whether adjustments to communication, reporting channels, or controls should follow?

An event is no substitute for an ongoing program. The NCSC describes security culture as a long-term endeavor and recommends continuous refreshers. Anyone selecting an event should therefore determine before the date how results will be documented and which follow-up topics will be derived from it.

When a platform fits

A platform fits when awareness needs to be organized on a recurring basis, across varying time windows, or for multiple target audiences. The operating model shifts more control into the organization: managers select topics, coordinate usage, oversee internal communication, and evaluate available metrics.

This increases governance requirements. Before making a choice, it should be clear who prioritizes content, how new employees are onboarded, at what rhythm topics rotate, and how feedback is addressed. Just as important are the limits of measurement. Completion rates or game scores are data from a training context. They must not be interpreted as direct proof of behavior during real incidents.

A platform is therefore particularly suitable when a company is not just looking for access to content, but aims to run an ongoing process. Without this process, even an extensive offering can easily remain unused or be reduced to an annual compliance checkbox.

Why the combination requires a handover plan

An event and a platform can be combined if each format is given a clearly defined purpose. A facilitated session can focus attention and ease the shared entry point. The platform can subsequently enable further team or solo use and provide insights for topic planning.

Organizationally, this combination only works with a clear handover. The event needs a designated owner for follow-up, an agreed next milestone, and a decision on which findings will be pursued. Without this plan, the result is two disconnected measures rather than a cohesive program.

For CISOs, the interface with other security functions is crucial. Awareness metrics replace neither incident response, technical controls, nor process audits. However, they can indicate which topics should be explained again, discussed collaboratively, or reviewed with the relevant business departments.

Positioning What The Hack! as an event or platform

What The Hack! offers a facilitated event online or hybrid on site. In a team format, employees discuss security scenarios and agree on an answer. Those planning an accompanied, time-concentrated start can consider the facilitated security awareness team event as a fitting operating model.

For recurring self-driven use, team formats, solo mode, and selectable topic campaigns are available. Following sessions, game scores, evaluations, and certificates of completion are accessible. Managers can use this information for documentation and topic prioritization without inferring a guaranteed behavioral or risk-reduction impact. The security awareness platform is thus suited for organizations looking to steer cadence and execution themselves.

The product decision should nevertheless begin with the security goal. An event makes sense when facilitation and a shared timeframe are needed. The platform makes sense when recurring internal operations are planned. The combination is right when the handover between both formats is firmly established.

Conclusion: Clarify the goal and operations first, then choose the format

The question of "event or platform?" cannot be answered with a blanket ranking. An event focuses attention and dialogue. A platform supports repetition, distributed use, and ongoing evaluation. Both formats require clear goals, defined responsibilities, and a defined next step.

When choosing, CISOs should therefore first map out the operating model: target audience, cadence, internal ownership, required reporting, and follow-up processes. Only then will it become clear whether a facilitated event, a platform, or a planned combination represents the more sustainable decision.

Sources

• ENISA: AR-in-a-Box

• UK National Cyber Security Centre: Cyber Assessment Framework – Staff awareness and training