Find free micro learning opportunities. Micro learning is convenient, includes different formats, and gives users more control over their own learning. Micro learning does not replace formal training, such as elearning modules or instructor-led training, but rather supplements it.

The most important aspects of micro learning are chunking and delivery methods. This includes spaced repetition and repeated retrieval. Instead of making your users sit through one hour-long course that covers 10 important topics, use 10 short videos or modules (under 4 minutes) that they take at different intervals, supplemented with quizzes, games, articles or other videos on the same subjects. People also forget 79% of new information within a few days, so spacing out their learning will increase retention. We recommend releasing content every two weeks to be frequent without bogging your users down with too much information, and using different formats for each push.

Don’t overwhelm your users. Keep in mind the average attention span is about 90 seconds, and a brain can process about 4-5 pieces of information at a time. All micro learning opportunities need to be easy to access and engaging because the actual act of learning new information is hard, requiring a lot of brain power; you don’t want to make accessing the learning material hard and use up some of the available brain bandwidth.

Curate the best resources for your users so they don’t have to. is a wonderful tool for aggregating relevant news from a variety of sources. Create a portal of resources people can access whenever they need it — in the Google age, we want something when we want it or need it, not when someone else wants us to have it.

Create a YouTube channel. You never have to create your own content. Instead, create playlists where you curate the best educational videos about information security.

Be where your users already are. If your user base is active on social media, be there. Create a Twitter account, a Facebook group, or a LinkedIn discussion group for your security department, encourage your employees to follow, like, join in order to receive important security news, company updates, resources to make their jobs easier, reminders about training, links to policy documents, etc.

Give your users a safe place to ask questions and find resources. If you have a company intranet, use it to your advantage! If you have a SharePoint site, carve out a space for security resources and awareness materials. If you don’t have anything in-house that you can use, create a private Facebook Group. It’s free, private, controllable, and it’s somewhere your users already are. Once you have a place for users to go, start discussions, post the games you’ve created and links to new videos in your YouTube video playlist, post reminders about upcoming events or training deadlines, and create a safe environment for them to ask questions.

Make information impossible to ignore. Create a screensaver (or use one of ours) using posters and informational graphics. Hang posters on the backs of bathroom stalls. Post reminders in the break room. Create fun digital signage for the lobby monitors. Include password tips on company pens. Pass out sticky pads with Incident Response information on them. Create security awareness calendars for employees to hang in their cubicles.

Use free online study guides. Some of our favorites for educating on a budget:
Quizlet: Create flashcards and study sets, and short quizzes users can complete on their time and from their mobile devices.
StudyBlue: very similar to Quizlet but you can add one image to one side of flashcards.

Make it fun and use games. Games increase both retention and employee productivity. And most users agree that they would be more productive if their learning was more game-like. (Don’t have time to make your own? We have lots already created and ready to download in our Freebie archive!)

Some free resources to create your own games:
Crossword Labs Crossword Puzzle
Quia: Create game-like quizzes

Make it personal. Your users care more about themselves and their families than they do about your organization. So teach them how to secure their personal lives in order to teach them how to be secure set work. Memory is emotional, so if you can drive emotion, you can drive knowledge and behavior change.

Ashley Schwartau

Director of Production & Creative Development at SAC
After more than 15 years of working in this industry, she’s finally accepted – and embraced! – the fact that she’s a security awareness expert. She is also a book-loving, travel-blogging, French-speaking Gryffindor who is unapologetically obsessed with her cats.