Just in Time Security Coaching: Respond at the Click

The human element was present in 62% of the breaches analyzed in the 2026 Data Breach Investigations Report, up from 60% the year before. Security awareness microlearning is one way to reach those people between the annual course and the next incident. This post is for security awareness managers deciding how to run it across a large workforce.

‍

In short: Short lessons only help when the right one reaches the right person. Codex uses agentic AI to recommend or assign each person's next lesson from their training gaps and behavior, so nobody has to schedule it by hand.

‍

What Security Awareness Microlearning Must Decide

Most definitions of microlearning start with length: a lesson short enough to finish between meetings. Length is the easy part. The harder decisions are which lesson, for whom and when, and across thousands of employees nobody can make those calls by hand.

‍

Those decisions differ by attack. Phishing asks a person to click, while pretexting, where an attacker builds a believable story, asks a help desk agent or a finance clerk to act. The same report found that in phishing simulations the median click rate for mobile-centric lures, such as fake texts and calls, was 40% higher than for email.

‍

‍

A course written last year will not reflect that shift. A library of short lessons that a system chooses from can, which is why cybersecurity microlearning depends more on the selection logic than on the lesson format.

‍

NIST takes a similar view in SP 800-50 Rev. 1, which describes a learning program as a life cycle that encourages behavior change as part of risk management. A lesson fits that description when it responds to what the person did last.

‍

How AI Microlearning Picks the Next Lesson

In Codex, Fraus's agentic AI recommends or assigns each person's lessons from their training gaps and behavioral signals. The lessons are bite-sized and built into everyday work, so people meet them during the job instead of in a scheduled course block. That is the practical meaning of AI microlearning here: the AI makes the selection, and the admin sets the limits.

‍

Gaps. A training gap is a topic a person has not yet covered, such as business email compromise or deepfake calls, both of which Codex teaches. Lessons are chosen to close that gap rather than to repeat the whole catalog.

‍

Behavior. Someone who reports a simulated phish quickly and someone who enters credentials do not need the same next lesson. Odin, the Fraus human risk management product, tracks those signals through continuous per-employee risk scoring.

‍

Role. Codex also has role-based learning paths and contextual lessons built on real-world scenarios, so the scenarios can differ for an accounts payable clerk and an executive assistant. Lessons are available in Arabic and English, which lets a mixed workforce learn in the language it works in.

‍

Nudges, Rules and Approval Gates

Not every prompt has to be a lesson. Security awareness nudges are shorter reminders, and Codex includes them alongside full lessons. With Agentic Automation Rules, one rule can assign a nudge, module or video when a trigger fires, such as a simulation result, a training event or a risk score change.

‍

Higher-stakes actions, such as step-up MFA or a finance approval hold, always wait for analyst approval. For events no rule covers, the agentic AI writes a contextual rule and acts in Off, Supervised or Unsupervised mode. In Supervised mode approvers confirm by email, and Unsupervised mode starts only after a 30-day trial in which it still asks first.

‍

A related idea is just-in-time coaching, where training reaches a person the moment their behavior shows a risk. Fraus delivers that inside Microsoft Teams through Zero-Touch Training. This post stays with lessons assigned ahead of that moment.

‍

Measuring Cybersecurity Microlearning

A completion rate shows that a lesson was opened, not that anything changed. Judge the program on behavior instead: reporting rate next to click rate, time to report, and whether the same person repeats the same mistake.

‍

Compare results by role and department rather than against one company average, and watch whether a person's risk score moves after assigned lessons. The post on security awareness KPIs for the board shows how to condense this onto one page.

‍

In the UAE the case for tracking this is practical. The UAE Government's Cybersecurity Council said in January 2026 that fraudulent messages had increased by 35% over the past year and called awareness the first line of defense, as Gulf News reported.

‍

Start With One Group This Quarter

Go back to the 62%. Those people are your finance team, your help desk and your executives, and each group needs a different next lesson. A first pass can stay small:

‍

• Pick one high-exposure group, such as finance or the help desk.
• Let Codex recommend lessons for that group from their gaps and behavior.
• Run the agentic rules in Supervised mode so approvers confirm each action.
• Track reporting rate and repeat behavior as your two measures.
• Review the results after 30 days before widening the group.

‍

Once the first group shows movement, extend the same setup to the next one.

‍

Frequently Asked Questions

What is security awareness microlearning?

‍

It is security training delivered as short lessons on one topic each, chosen for the person receiving them. Instead of one annual course for everyone, employees get small pieces tied to their role, gaps and behavior, which makes it easier to cover new threats as they appear.

‍

How is AI microlearning different from a monthly short video?

‍

A monthly video goes to everyone on the same schedule. With AI microlearning in Codex, the agentic AI recommends or assigns each person's lessons from their training gaps and behavioral signals, so two employees in the same week can receive different content.

‍

Do security awareness nudges replace lessons?

‍

No. Nudges are shorter reminders that keep a behavior in view, while lessons teach it. Codex includes both, and automation rules can assign either when a trigger fires, such as a simulation result or a change in risk score.

‍

Can the AI assign lessons without an administrator?

‍

Admins choose the mode. In Supervised mode approvers confirm by email before the agentic AI acts. Unsupervised mode begins after a 30-day trial in which it still asks first. Admin rules take priority, and every agentic action is logged for audit.

‍

Does microlearning replace annual training?

‍

It depends on your obligations. Many organizations keep a baseline course for everyone, and Codex includes compliance mapping. Microlearning then covers the gaps that remain for each person, between the annual cycles.

Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches, as reported by Help Net Security. For the security awareness manager or SOC lead who owns what happens next, the follow-up is often a person copying names into a spreadsheet and sending reminders by hand. This post shows those teams how security awareness automation is built so it holds up in front of an auditor.

‍

In short: Security awareness automation works when every rule names a trigger, an audience and an action, sends high-stakes actions to an analyst for approval, can be tested before it goes live, and leaves a log.

‍

Security Awareness Automation Starts With Rules

A rule is a plain sentence: when this event happens to these people, do this. A reminder, a policy re-attestation and a training assignment can all be written that way, which makes human risk automation rules easier to review than a long list of campaigns. Chained together, they become automated security awareness workflows that a department head can read in a minute.

‍

The signal behind a rule is rarely a surprise. The report's executive summary lists phishing as the way in for 16% of breaches, unchanged from the year before, behind vulnerability exploitation at 31% and ahead of credential abuse at 13%. Those figures describe the attacker's side. A rule describes your response, and the response is where most programs lose days.

‍

‍

Fraus builds that response as automation rules. The sections below follow the order in which a rule is written, run and trusted.

‍

Triggers, Audiences and Actions

Triggers. Rules start from events in seven categories: simulation results, identity, endpoint, data loss prevention, directory, training and risk score events. The mix matters. A simulation result shows how someone behaved in a test, an identity or endpoint event shows what happened on a real system, and a risk score event shows that the overall picture has changed. How simulations themselves run is covered in automated phishing simulation.

‍

Audiences. An audience is built from presets, departments, directory groups and named people. Pointing a rule at a directory group means it can follow a group you already maintain, instead of a list someone has to remember to update.

‍

Actions. One rule can assign nudges, modules, videos, policies or posters, and notify role groups or the employee's manager. Keep each rule narrow. A rule that sends one nudge to one department after one kind of event is easy to explain and easy to switch off. For the moment a person shows risk, just-in-time coaching in Microsoft Teams covers the immediate response, and rules cover the policy around it.

‍

Approval Gates, Chaining and Schedules

Some actions should never fire alone. In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. That gate is what lets a security team accept automation for the routine work, because the consequential work still passes a person.

‍

Chaining and escalation. A rule can chain into another and escalate when an action goes unacknowledged. A nudge that is ignored can become a note to the employee's manager. Write the escalation path before launch, and make sure it ends with a named owner rather than a shared inbox.

‍

Scheduled rules. Not every rule waits for an event. Weekly, monthly, quarterly and annual schedules cover executive reports, policy re-attestation and risk score recalculation. These are the duties a calendar reminder used to carry, and they are the ones that slip in the month an audit arrives.

‍

Recommend, Test, Then Trust

Writing rules from a blank page stalls programs. Odin proposes ready-to-apply rules, each with an estimated 30-day match count and its reasoning. The match count tells you how busy a rule would have been, which is the first thing an approver asks.

‍

Before anything goes live, run the rule through test before you trust. It simulates an event and shows what would happen, so you read the outcome before an employee does. Test with the audience that would be most embarrassed by a wrong message, usually executives or finance, and check the rule against this list.

‍

• The trigger names one event and one condition.
• The audience is a group someone owns.
• Any action touching access or payments goes to an analyst.
• The escalation path ends with a named person.
• The test event produced the result you expected.

‍

When No Rule Covers the Event

Rules cover what you foresaw. For events no rule covers, agentic AI writes a contextual rule and acts, in one of three modes. Off keeps it from acting. Supervised sends each proposed action to approvers, who confirm by email. Unsupervised lets it act on its own, but only after a 30-day trial in which it still asks first.

‍

Admin rules take priority over anything the agentic AI writes. Every rule is labeled by origin, so you can tell an analyst's rule from an AI-written one, and every agentic action is logged for audit. That record answers the question a CISO or auditor will ask sooner or later: who decided this, and when.

‍

Start With Three Rules

Go back to the spreadsheet from the start. Pick the three follow-ups your team repeats most, write each as a trigger, an audience and an action, and test them. Keep the agentic AI in Supervised mode until the audit log has earned a case for more. Then see how the pieces fit together on the agentic automation rules page.

‍

Frequently Asked Questions

What is security awareness automation?

‍

It is the practice of letting rules run the follow-up work in a security awareness program. An event, such as a simulation result or a risk score change, triggers an action for a defined audience, such as a nudge, a module or a manager notification, without anyone sending it by hand.

‍

What should a security awareness automation rule include?

‍

Every rule needs a trigger, an audience and an action. Add an approval gate for anything that touches access or payments, an escalation step for actions nobody acknowledges, and a test before it goes live. Label the rule by origin so the audit log shows who or what created it.

‍

Which actions should wait for an analyst?

‍

In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. Use the same test for your own rules: if a wrong action would block someone's access or delay a payment, a person should confirm it first.

‍

What do Off, Supervised and Unsupervised mean?

‍

They are the modes for agentic AI when no rule covers an event. Off means it does not act. Supervised means approvers confirm its proposed actions by email. Unsupervised means it acts on its own after a 30-day trial in which it still asks first. Every action is logged for audit.

A phishing campaign comes with a calendar. Someone picks a theme, builds the template, chooses the audience, launches, waits, pulls the report, briefs management and starts again next quarter. For a security awareness manager on a lean team, that cycle is the program, and it quietly decides how often anyone is tested. This post is for the people who run that cycle and want to see what autonomous phishing simulation looks like once it is gone.

‍

In short: Autonomous phishing simulation replaces the campaign cycle with agentic AI that picks each person's next simulation, difficulty, trigger and timing. You set guardrails once, and your team acts only when the system asks.

‍

Why Campaigns Cap Your Program

A campaign treats the workforce as one audience. Everyone gets the same lure at the same moment, so the result describes the template as much as the people. NIST built its Phish Scale with this in mind. It rates a phishing email's content across five elements to give a difficulty of low, medium or high, so a click rate can be read against how hard the lure was to detect. NIST describes the method in its own words.

‍

Most breaches run through people. Verizon's 2026 Data Breach Investigations Report found that human involvement contributed to 62% of breaches in 2025. Against that, a quarterly campaign leaves up to three months with no fresh signal on any individual.

‍

‍

That is the gap a campaign calendar leaves open. Closing it with more campaigns means more planning, more launches and more reviews, which is exactly what a small team cannot add.

‍

What Autonomous Phishing Simulation Means

Autonomous phishing simulation is a program where the system, not an administrator, decides what each person receives and when. Continuous phishing simulation is the visible result: simulations reach each person at their own pace all year instead of in waves. You will also see it called campaignless phishing or phishing without campaigns, and both phrases describe what disappears: the campaign itself, with its audience list, launch date and end date.

‍

Agentic AI phishing simulation is how that works in practice: an agent looks at the individual and chooses the next step. The wider question of what automation should run and what a team keeps is covered in Automated Phishing Simulation: What Runs, What You Keep. This post stays on the model where the campaign is removed.

‍

How Graybait Runs Without Campaigns

Graybait is the Fraus phishing program built on this model. Setup is four steps, then it runs for twelve months with minimal administrative effort:

‍

1. Connect the workforce.
2. Set guardrails.
3. Choose an objective.
4. Activate.

‍

From there the agentic AI picks or generates each employee's next simulation from their Human Risk Profile. It sets the difficulty, theme, psychological trigger and timing for that person. Lures match the person's role, context and history, so someone in finance and someone in facilities need not receive the same message.

‍

Difficulty moves with the individual. It rises as a person keeps spotting attacks, and a method is retired once that person has beaten it. Frequency follows each person's risk, within the limits an admin sets. A colleague who keeps spotting lures is not pulled into the same routine as one who struggles.

‍

What Happens When the System Asks

After activation, the team steps in only when the system asks. The work shifts from producing simulations to responding to requests, and the new way to stall is a request that nobody owns. Name one person who answers, and a backup, before you activate.

‍

The same principle runs through other Fraus agentic work. In Agentic Automation Rules, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval, and every agentic action is logged for audit. Asking first is part of the design.

‍

Then comes the long middle. The program runs for twelve months after the four setup steps, with no launch dates inside it.

‍

Inside that year, one person is moving to harder lures because they keep spotting attacks. Another has beaten a method, so it is retired for them. A third is tested more often because their risk is higher. Your calendar shows none of this, which is why reporting needs a different shape.

‍

Reporting With No Campaign Report

Management is used to a report at the end of each campaign. With none, you report what Graybait tracks for each person and across the workforce:

‍

• Individual susceptibility over time. A trend for each person instead of one rate per wave, so you can say whether people are getting harder to fool rather than how a single template performed.
• Weakness coverage. How far the program has reached into each person's weak spots, which answers what has not been tested yet.
• Difficulty progression. How the difficulty has risen as people keep spotting attacks, which shows leadership that the program is not stalling at an easy level.

‍

Risk also needs a home outside the simulation. Odin scores each employee's risk continuously and weights it by role criticality, which helps you read these views next to the rest of the picture.

‍

Leaving the Campaign Calendar

Go back to the calendar from the start. Switching means stopping a few habits: building templates, setting launch dates and writing an end-of-campaign report. The slot you held in the management meeting stays, and the three views above fill it.

‍

Staff and managers need a short heads-up. Simulations now reach each person on their own schedule through the year, so colleagues are less likely to compare notes about the phishing test going round this week. Managers should expect to be asked for context when a pattern needs a conversation.

‍

Your next step is to pick who answers the system and which management meeting will receive the first reporting views. Then see how Graybait handles the rest.

‍

Frequently Asked Questions

What is autonomous phishing simulation?

‍

It is a phishing simulation program where agentic AI, not an administrator, decides what each person receives, how hard it is and when it arrives. There are no campaigns to plan, launch or review. The team sets limits and an objective at the start, then responds when the system asks for input.

‍

Does phishing without campaigns mean losing control?

‍

No. You set the guardrails and choose the objective before activation, and frequency follows each person's risk within the limits an admin sets. What you give up is the manual work of building and launching each wave, not the authority over what the program may do.

‍

How is this different from automated phishing simulation?

‍

Automation can mean a scheduler that still sends campaigns on a timer. The campaignless model removes the campaign, so each person gets a simulation chosen for them. The published guide on automated phishing simulation explains what automation should run and what a team keeps.

‍

How does Graybait get started?

‍

Setup is four steps: connect the workforce, set guardrails, choose an objective and activate. It then runs for twelve months, and the team steps in only when the system asks. Talk to Fraus about your environment and objectives before choosing guardrails.