Arabic Security Awareness Training: Authored or Translated?

Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches, as reported by Help Net Security. For the security awareness manager or SOC lead who owns what happens next, the follow-up is often a person copying names into a spreadsheet and sending reminders by hand. This post shows those teams how security awareness automation is built so it holds up in front of an auditor.

‍

In short: Security awareness automation works when every rule names a trigger, an audience and an action, sends high-stakes actions to an analyst for approval, can be tested before it goes live, and leaves a log.

‍

Security Awareness Automation Starts With Rules

A rule is a plain sentence: when this event happens to these people, do this. A reminder, a policy re-attestation and a training assignment can all be written that way, which makes human risk automation rules easier to review than a long list of campaigns. Chained together, they become automated security awareness workflows that a department head can read in a minute.

‍

The signal behind a rule is rarely a surprise. The report's executive summary lists phishing as the way in for 16% of breaches, unchanged from the year before, behind vulnerability exploitation at 31% and ahead of credential abuse at 13%. Those figures describe the attacker's side. A rule describes your response, and the response is where most programs lose days.

‍

‍

Fraus builds that response as automation rules. The sections below follow the order in which a rule is written, run and trusted.

‍

Triggers, Audiences and Actions

Triggers. Rules start from events in seven categories: simulation results, identity, endpoint, data loss prevention, directory, training and risk score events. The mix matters. A simulation result shows how someone behaved in a test, an identity or endpoint event shows what happened on a real system, and a risk score event shows that the overall picture has changed. How simulations themselves run is covered in automated phishing simulation.

‍

Audiences. An audience is built from presets, departments, directory groups and named people. Pointing a rule at a directory group means it can follow a group you already maintain, instead of a list someone has to remember to update.

‍

Actions. One rule can assign nudges, modules, videos, policies or posters, and notify role groups or the employee's manager. Keep each rule narrow. A rule that sends one nudge to one department after one kind of event is easy to explain and easy to switch off. For the moment a person shows risk, just-in-time coaching in Microsoft Teams covers the immediate response, and rules cover the policy around it.

‍

Approval Gates, Chaining and Schedules

Some actions should never fire alone. In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. That gate is what lets a security team accept automation for the routine work, because the consequential work still passes a person.

‍

Chaining and escalation. A rule can chain into another and escalate when an action goes unacknowledged. A nudge that is ignored can become a note to the employee's manager. Write the escalation path before launch, and make sure it ends with a named owner rather than a shared inbox.

‍

Scheduled rules. Not every rule waits for an event. Weekly, monthly, quarterly and annual schedules cover executive reports, policy re-attestation and risk score recalculation. These are the duties a calendar reminder used to carry, and they are the ones that slip in the month an audit arrives.

‍

Recommend, Test, Then Trust

Writing rules from a blank page stalls programs. Odin proposes ready-to-apply rules, each with an estimated 30-day match count and its reasoning. The match count tells you how busy a rule would have been, which is the first thing an approver asks.

‍

Before anything goes live, run the rule through test before you trust. It simulates an event and shows what would happen, so you read the outcome before an employee does. Test with the audience that would be most embarrassed by a wrong message, usually executives or finance, and check the rule against this list.

‍

• The trigger names one event and one condition.
• The audience is a group someone owns.
• Any action touching access or payments goes to an analyst.
• The escalation path ends with a named person.
• The test event produced the result you expected.

‍

When No Rule Covers the Event

Rules cover what you foresaw. For events no rule covers, agentic AI writes a contextual rule and acts, in one of three modes. Off keeps it from acting. Supervised sends each proposed action to approvers, who confirm by email. Unsupervised lets it act on its own, but only after a 30-day trial in which it still asks first.

‍

Admin rules take priority over anything the agentic AI writes. Every rule is labeled by origin, so you can tell an analyst's rule from an AI-written one, and every agentic action is logged for audit. That record answers the question a CISO or auditor will ask sooner or later: who decided this, and when.

‍

Start With Three Rules

Go back to the spreadsheet from the start. Pick the three follow-ups your team repeats most, write each as a trigger, an audience and an action, and test them. Keep the agentic AI in Supervised mode until the audit log has earned a case for more. Then see how the pieces fit together on the agentic automation rules page.

‍

Frequently Asked Questions

What is security awareness automation?

‍

It is the practice of letting rules run the follow-up work in a security awareness program. An event, such as a simulation result or a risk score change, triggers an action for a defined audience, such as a nudge, a module or a manager notification, without anyone sending it by hand.

‍

What should a security awareness automation rule include?

‍

Every rule needs a trigger, an audience and an action. Add an approval gate for anything that touches access or payments, an escalation step for actions nobody acknowledges, and a test before it goes live. Label the rule by origin so the audit log shows who or what created it.

‍

Which actions should wait for an analyst?

‍

In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. Use the same test for your own rules: if a wrong action would block someone's access or delay a payment, a person should confirm it first.

‍

What do Off, Supervised and Unsupervised mean?

‍

They are the modes for agentic AI when no rule covers an event. Off means it does not act. Supervised means approvers confirm its proposed actions by email. Unsupervised means it acts on its own after a 30-day trial in which it still asks first. Every action is logged for audit.

A phishing campaign comes with a calendar. Someone picks a theme, builds the template, chooses the audience, launches, waits, pulls the report, briefs management and starts again next quarter. For a security awareness manager on a lean team, that cycle is the program, and it quietly decides how often anyone is tested. This post is for the people who run that cycle and want to see what autonomous phishing simulation looks like once it is gone.

‍

In short: Autonomous phishing simulation replaces the campaign cycle with agentic AI that picks each person's next simulation, difficulty, trigger and timing. You set guardrails once, and your team acts only when the system asks.

‍

Why Campaigns Cap Your Program

A campaign treats the workforce as one audience. Everyone gets the same lure at the same moment, so the result describes the template as much as the people. NIST built its Phish Scale with this in mind. It rates a phishing email's content across five elements to give a difficulty of low, medium or high, so a click rate can be read against how hard the lure was to detect. NIST describes the method in its own words.

‍

Most breaches run through people. Verizon's 2026 Data Breach Investigations Report found that human involvement contributed to 62% of breaches in 2025. Against that, a quarterly campaign leaves up to three months with no fresh signal on any individual.

‍

‍

That is the gap a campaign calendar leaves open. Closing it with more campaigns means more planning, more launches and more reviews, which is exactly what a small team cannot add.

‍

What Autonomous Phishing Simulation Means

Autonomous phishing simulation is a program where the system, not an administrator, decides what each person receives and when. Continuous phishing simulation is the visible result: simulations reach each person at their own pace all year instead of in waves. You will also see it called campaignless phishing or phishing without campaigns, and both phrases describe what disappears: the campaign itself, with its audience list, launch date and end date.

‍

Agentic AI phishing simulation is how that works in practice: an agent looks at the individual and chooses the next step. The wider question of what automation should run and what a team keeps is covered in Automated Phishing Simulation: What Runs, What You Keep. This post stays on the model where the campaign is removed.

‍

How Graybait Runs Without Campaigns

Graybait is the Fraus phishing program built on this model. Setup is four steps, then it runs for twelve months with minimal administrative effort:

‍

1. Connect the workforce.
2. Set guardrails.
3. Choose an objective.
4. Activate.

‍

From there the agentic AI picks or generates each employee's next simulation from their Human Risk Profile. It sets the difficulty, theme, psychological trigger and timing for that person. Lures match the person's role, context and history, so someone in finance and someone in facilities need not receive the same message.

‍

Difficulty moves with the individual. It rises as a person keeps spotting attacks, and a method is retired once that person has beaten it. Frequency follows each person's risk, within the limits an admin sets. A colleague who keeps spotting lures is not pulled into the same routine as one who struggles.

‍

What Happens When the System Asks

After activation, the team steps in only when the system asks. The work shifts from producing simulations to responding to requests, and the new way to stall is a request that nobody owns. Name one person who answers, and a backup, before you activate.

‍

The same principle runs through other Fraus agentic work. In Agentic Automation Rules, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval, and every agentic action is logged for audit. Asking first is part of the design.

‍

Then comes the long middle. The program runs for twelve months after the four setup steps, with no launch dates inside it.

‍

Inside that year, one person is moving to harder lures because they keep spotting attacks. Another has beaten a method, so it is retired for them. A third is tested more often because their risk is higher. Your calendar shows none of this, which is why reporting needs a different shape.

‍

Reporting With No Campaign Report

Management is used to a report at the end of each campaign. With none, you report what Graybait tracks for each person and across the workforce:

‍

• Individual susceptibility over time. A trend for each person instead of one rate per wave, so you can say whether people are getting harder to fool rather than how a single template performed.
• Weakness coverage. How far the program has reached into each person's weak spots, which answers what has not been tested yet.
• Difficulty progression. How the difficulty has risen as people keep spotting attacks, which shows leadership that the program is not stalling at an easy level.

‍

Risk also needs a home outside the simulation. Odin scores each employee's risk continuously and weights it by role criticality, which helps you read these views next to the rest of the picture.

‍

Leaving the Campaign Calendar

Go back to the calendar from the start. Switching means stopping a few habits: building templates, setting launch dates and writing an end-of-campaign report. The slot you held in the management meeting stays, and the three views above fill it.

‍

Staff and managers need a short heads-up. Simulations now reach each person on their own schedule through the year, so colleagues are less likely to compare notes about the phishing test going round this week. Managers should expect to be asked for context when a pattern needs a conversation.

‍

Your next step is to pick who answers the system and which management meeting will receive the first reporting views. Then see how Graybait handles the rest.

‍

Frequently Asked Questions

What is autonomous phishing simulation?

‍

It is a phishing simulation program where agentic AI, not an administrator, decides what each person receives, how hard it is and when it arrives. There are no campaigns to plan, launch or review. The team sets limits and an objective at the start, then responds when the system asks for input.

‍

Does phishing without campaigns mean losing control?

‍

No. You set the guardrails and choose the objective before activation, and frequency follows each person's risk within the limits an admin sets. What you give up is the manual work of building and launching each wave, not the authority over what the program may do.

‍

How is this different from automated phishing simulation?

‍

Automation can mean a scheduler that still sends campaigns on a timer. The campaignless model removes the campaign, so each person gets a simulation chosen for them. The published guide on automated phishing simulation explains what automation should run and what a team keeps.

‍

How does Graybait get started?

‍

Setup is four steps: connect the workforce, set guardrails, choose an objective and activate. It then runs for twelve months, and the team steps in only when the system asks. Talk to Fraus about your environment and objectives before choosing guardrails.

The UAE Cyber Security Council said the country recorded more than 800,000 cyberattacks a day in recent months, as reported by Gulf News in May 2026. Filters and firewalls absorb the volume, and what is left comes down to a person deciding whether to open, pay or reply. This post is for the CISO or awareness manager who has to choose a training program for a UAE workforce and defend that choice to the board.

‍

‍

In short: Test any security awareness training UAE vendor on four things: whether it works in Arabic and English, whether its scenarios match local threats, whether it maps to UAE frameworks you answer to, and whether it measures behavior rather than course completions.

‍

Security Awareness Training UAE Buyers Should Test

Most vendor demos show a course library and a completion dashboard. That tells you the content exists, not that it will change what your accounts payable clerk does on the day before a payment run. The four tests below are the ones that separate a program a UAE organization can run for years from one that gets switched off after the first audit.

‍

They also come in a useful order. Language decides whether anyone engages, local threats decide whether the content feels real, regulation decides whether the program survives review, and measurement decides whether you can show it worked. We take them in that order.

‍

Language Decides Whether Training Gets Used

Many UAE organizations employ people with different first languages. A Dubai finance team may work in English and speak Arabic at home, while site and operations staff may be more comfortable in other languages again. Training that exists only in English, or in a machine-translated Arabic that reads like a form letter, quietly excludes the people who most need it.

‍

What to check. Ask to see the same scenario in Arabic and English, written natively rather than translated line by line. For security awareness training in Dubai that teams will actually finish, short micro-learning modules matter as much as language, because staff complete a five-minute lesson between tasks far more readily than a one-hour course.

‍

Codex delivers training in Arabic and English for this reason. Language also decides how well local content lands, which brings us to the threats themselves.

‍

Local Threats Belong in the Content

Generic examples about a fictional parcel delivery do little for someone who handles supplier payments. In August 2026 the Council's chairman warned of rising phishing, ransomware and zero-day attacks, with AI-driven threats intensifying, in a statement carried by Emirates 24|7. Cybersecurity awareness training in the UAE should therefore cover the lures staff will meet this quarter.

‍

In practice that means business email compromise aimed at finance teams, a supplier's changed bank details, deepfake voice or video requests from a senior executive, and staff pasting company data into public GenAI tools. Our posts on business email compromise training and invoice fraud in UAE construction show how those cases look from the employee's side.

‍

Ask any vendor how often its scenarios are updated, and whether a person in finance sees different content from a person in HR. If the answer is an annual refresh for everyone, the content will lag the threats described above.

‍

Aligning Training With UAE Regulation

Regulation is where buyers most often overclaim, so be precise. The UAE Information Assurance Regulation, published on the TDRA website, states that an awareness and training program shall be implemented to inform entities of the risks associated with their activities. It obliges UAE government entities and other entities the regulator designates as critical, and recommends adoption by all other entities in the UAE on a voluntary basis.

‍

Separately, the UAE's personal data protection law has been in force since 2 January 2022, and the government's own summary describes it as setting general obligations on companies that hold personal data to secure it. Training is one practical way to support that duty and show how staff are prepared to handle personal data. For program design, NIST SP 800-50 Rev. 1 offers a life cycle approach to a learning program that encourages behavior change and includes suggested metrics.

‍

The useful buying question is whether a vendor can map its modules to the controls you are audited against and produce evidence of who learned what. Codex includes compliance mapping, and Fraus itself is ISO/IEC 27001 certified, UAE IA compliant and aligned with the NIST Cybersecurity Framework. It can be hosted on UAE or GCC servers or deployed fully on-premise, which matters if your data residency rules are strict.

‍

Measure Behavior, Not Completions

A completion rate close to 100% shows that people clicked through slides. It does not show that anyone now stops before approving a changed bank account. Auditors may accept completion as evidence of delivery, but your board will eventually ask whether risk went down.

‍

The measures that answer that are the reporting rate, the time it takes to report a suspicious message, and whether the same people repeat the same mistake. We set out how to present them in Security Awareness KPIs for the Board on One Page, and how scoring each person's risk changes what training they get in Human Risk Management vs Security Awareness Training.

‍

Training measured this way works best when it connects to simulation and to per-person risk scoring. Odin scores risk for each employee continuously, so the next lesson can follow the behavior rather than the calendar. If you are also choosing a simulation tool, our guide to phishing simulation in the UAE covers that side.

‍

Next Step Before You Shortlist

Of the 800,000 attacks a day, the few that get through will land with your busiest, least-supported staff, so test with them. Before signing, run a short pilot with one finance team and one operations team, and ask each vendor for the following.

‍

• The same scenario in Arabic and in English, shown to a native reader
• Two scenarios written for your sector and current threats
• A mapping from modules to the UAE IA or other framework controls you are audited against
• A sample report showing reporting rate, time to report and repeat behavior
• Hosting options that match your data residency rules

‍

Score the answers against the four tests above. If you want to see how Arabic and English micro-learning, deepfake and business email compromise content and compliance mapping fit together, the Codex page is the place to start.

‍

Frequently Asked Questions

Is security awareness training mandatory in the UAE?

‍

The UAE Information Assurance Regulation requires an awareness and training program for UAE government entities and entities the regulator designates as critical. It recommends all other UAE entities adopt it voluntarily. Sector regulators and your contracts may add their own requirements, so confirm which frameworks apply to you.

‍

Does training need to be in Arabic?

‍

A program only works if staff understand it, and UAE workforces often read Arabic, English or both in daily work. Offer both at minimum, written natively rather than machine translated, and check which other languages your frontline and contract staff actually read before you finalize the content.

‍

How often should staff be trained?

‍

Check the framework you are audited against for any stated frequency, and do not claim one the text does not give. Short, continuous micro-learning tied to current threats and to each person's behavior is easier to sustain, and easier to evidence, than a single annual course.

‍

What should we report to the board?

‍

Report the reporting rate, time to report and repeat behavior by department, alongside completion. Those show whether behavior is changing, which completion alone cannot, and they give the board a trend it can compare from one quarter to the next without reading course statistics.