Want employees to pay attention to security awareness training? Make it accessible, pervasive and targeted to your audience.

There is a reason phishing scams remain popular. Despite the fact most knowledge workers know the risks of clicking on unknown attachments or links, a significant number of them continue to do it. A recent Harris Interactive survey found that 19 percent of U.S. employees working in an office said they had opened an email at work that they suspected could be a scam – and those were just the ones willing to admit it. Chances are, the actual number is higher.

Despite this, many security professionals focus on technology and treat user training as an afterthought.

“Most people buy first and train later, but that’s the wrong approach,” said Tom Nelson, an assistant professor who teaches Digital Forensics and Information Assurance at Marshall University and president and principal security consultant of Blackrock Consulting. “A next generation firewall is not going to protect you if a bad guy can get somebody inside to do something for them.”