An employee picks up the phone. The caller identifies himself as IT support and says there is an unusual login on the account. He needs to verify credentials right now. The employee obliges. Two hours later, payroll records sit in a stranger’s inbox.
No email filter would have caught that call. This is the problem that Proofpoint Security Awareness Training exists to solve: it addresses the human response to pressure, urgency, and authority that no gateway tool can reach.
Here’s the short version: Proofpoint Security Awareness Training is a security education platform that teaches employees to recognize and resist phishing, vishing, smishing, and other social engineering tactics through realistic simulations and just-in-time instruction. Organizations that run consistent, simulation-based programs can reduce employee click rates from an industry-average starting point of around 30% down to the low single digits within about a year, according to KnowBe4’s 2025 Phishing by Industry Benchmarking Report. Vircom delivers this training as part of its Proofpoint partnership for SMBs and MSPs worldwide.
Key Takeaways
-
The human element contributed to approximately 60% of confirmed data breaches, according to Verizon’s 2025 Data Breach Investigations Report, making employee behavior the most persistent vulnerability across every industry.
-
Email gateways block malicious payloads and known bad links, but they cannot prevent an employee from being manipulated into sharing credentials through a phishing email, a vishing call, or an SMS lure.
-
Proofpoint Security Awareness Training includes email phishing simulations, vishing and smishing curriculum, and teachable moments that trigger at the exact moment a simulation fails, not days later in a scheduled module.
-
Evaluating a security education platform requires checking simulation fidelity, content currency, just-in-time training capability, multi-channel coverage, and reporting depth before making a purchase decision.
What Is Proofpoint Security Awareness Training and Why Does It Matter?
Think of your email filter like a metal detector at an airport: it catches weapons before they reach the gate. Proofpoint Security Awareness Training is the security briefing that prepares passengers for what happens when someone engineers their way past the detector. Filters block malware and malicious links. Training changes what employees do when a threat gets through, or when the attack never arrives by email at all.
Proofpoint Security Awareness Training operates on the DICE framework: Detect, Intervene, Change, Evaluate. It works in four phases. First, it detects risk, whether that’s an external threat like a business email compromise attempt or an internal behavior that breaks policy. Second, it intervenes at the moment that risk surfaces, delivering a teachable moment right after a simulation failure or a flagged action. Third, it changes unsafe behavior through short, personalized micro-learning modules tied to that failure. Fourth, it evaluates program success through real-time dashboards that show individual risk scores and training completion rates across the organization.
The curriculum covers phishing (email-based attacks), vishing (voice-based social engineering via phone or VoIP), and smishing (SMS-based phishing), as well as business email compromise impersonation, ransomware awareness, mobile security, data protection, and generative AI risks. For organizations subject to compliance requirements, the content library includes modules relevant to HIPAA, PCI-DSS, and other frameworks, though the training applies broadly across every sector that handles sensitive client data.
This matters because most security awareness programs fail at the second step. They raise awareness once per year and move on. Proofpoint’s model creates a continuous feedback loop between simulation, failure, immediate instruction, and repeat measurement, which is the structure needed to actually change human behavior under pressure.
Why the Human Factor in Cyber Security Is Your Biggest Exposure
The Verizon 2025 Data Breach Investigations Report found that the human element contributed to approximately 60% of confirmed data breaches. That figure means the majority of incidents did not begin with an unpatched system or a zero-day exploit. They began with a person doing something an attacker had anticipated and planned for.
The FBI’s 2024 Internet Crime Complaint Center Annual Report puts a dollar figure on that pattern. Total cybercrime losses reached $16.6 billion in 2024, a 33% increase from the prior year. Phishing and spoofing ranked as the most reported crime type with 193,407 complaints filed with the IC3. Business email compromise, which depends almost entirely on social engineering to trick employees into authorizing fraudulent wire transfers or sharing credentials, accounted for $2.77 billion in losses in 2024 alone.
Proofpoint’s 2024 State of the Phish found that 68% of employees willingly take risky actions that could expose organizational data, often because they do not recognize the manipulation tactics directed at them. That figure includes clicking suspicious links, using corporate credentials on unapproved platforms, and complying with unusual requests from spoofed authority figures.
Filters and endpoint tools address the technical layer of this problem. The human layer requires a different approach. Organizations that handle client data, process financial transactions, or operate under regulatory oversight cannot treat employee awareness as optional. The cost of a single successful business email compromise attack routinely exceeds the annual cost of a comprehensive training program by a significant margin.
Not sure how your employees would respond to a real attack? Test it yourself:
Start Free Trial →
Common Social Engineering Tactics Your Employees Face Every Day
Understanding the attack methods that Proofpoint training addresses helps IT managers and MSPs select simulation scenarios that reflect actual risk, not hypothetical ones. These are the four most common social engineering tactics targeting organizations across all industries today.
Phishing arrives by email and mimics trusted senders: banks, cloud platforms, HR systems, IT helpdesks, and internal executives. Attackers layer urgency (“your account will be suspended”), spoofed branding, and forged sender addresses to trigger a click or credential entry before the recipient thinks critically about the request.
Vishing (voice phishing) reaches employees by phone or VoIP. The caller impersonates IT support, a vendor, a financial institution, or a known colleague. Vishing is particularly effective because employees associate phone calls with authenticity and rarely apply the same skepticism they give to a suspicious email link. Proofpoint’s vishing training helps address this gap directly by giving employees practiced verification habits to interrupt that assumption before they act.
Smishing delivers the same manipulation tactics as phishing but through text messages. A convincing SMS about a package delivery, payroll discrepancy, or urgent account verification can redirect an employee to a credential-harvesting page in seconds, on a personal device where corporate security controls may not apply.
Pretexting involves building a false identity or scenario over time, sometimes combining email, phone, and social media interaction to make the deception more convincing before the actual fraudulent request arrives. Many business email compromise attacks rely on pretexting to establish trust across multiple interactions before asking for a wire transfer authorization or credential reset.
Strong email phishing protection at the gateway reduces the volume of these attempts that reach inboxes. Training determines what employees do when one of them still lands.
How to Evaluate a Security Education Platform: A 5-Step Checklist
Use these eight criteria when comparing cloud email archiving solutions. Treat each item as a pass-or-fail requirement, not a weighted preference.
- Assess simulation fidelity. A useful simulation uses the same spoofed domains, urgency language, and impersonation tactics that actual attackers use, not generic test emails employees identify as fake within seconds. Ask the vendor how frequently their simulation template library updates and whether new templates reflect current phishing campaigns documented in threat intelligence feeds.
- Confirm multi-channel attack coverage. Phishing simulation is the minimum baseline. Evaluate whether the platform also runs vishing and smishing scenarios, since attackers rotate across channels when one is blocked or when employees in a particular organization have been trained to recognize email lures but not phone calls or texts.
- Require just-in-time teachable moments. Training delivered immediately after a simulation fail is significantly more effective than a scheduled module sent days later. The moment of failure is when the lesson registers most clearly. Confirm that the platform delivers in-context instruction at the exact point of employee interaction, not after a cooling-off period that allows the learning moment to pass.
- Demand reporting depth that supports stakeholder conversations. Aggregate pass/fail rates are insufficient. A strong platform provides per-user risk scoring, trend data across multiple simulation campaigns, and training completion rates over time. This data directly supports cyber insurance applications, compliance audit documentation, and internal risk reporting to leadership and board members who need quantifiable evidence of program effectiveness.
- Evaluate integration with your existing email security stack. A training platform that operates in complete isolation misses opportunities to correlate simulation data with real threat activity. Look for platforms that connect with your email gateway so that actual phishing attempts flagged by end users and simulation interaction data appear in a unified view. Confirm integration with PSA tools your team already uses for ticketing, billing, and client management.
Proofpoint Training vs. Other Approaches: A Direct Comparison
Not all approaches to security awareness deliver the same coverage or operational value. This table compares three options organizations evaluate when building the human risk layer of their security program.
| Capability | Native Microsoft 365 Attack Simulator | Generic Third-Party SAT |
Proofpoint Security Awareness Training via Vircom |
|---|---|---|---|
| Phishing simulations | Template-based, limited customization | Available; quality and fidelity vary by vendor | Continuously updated real-world templates aligned to current threat campaigns |
| Vishing and smishing coverage | Not included | Varies; many vendors are email-only | Included in core curriculum across all subscription tiers |
| Just-in-time teachable moments | Not available | Varies by vendor | Core feature: Phish Hooks and Teachable Moments fire at point of failure |
| Per-user risk reporting | Basic aggregate metrics only | Varies; often requires manual export and analysis | Real-time individual risk scoring with trend dashboards |
| Onboarding and operational support | Microsoft support tiers; no email security specialization | Varies by vendor size and service model | Dedicated Vircom engineering team with 30+ years of email security expertise |
Managing training across multiple client organizations? Talk to sales about MSP pricing:
Contact Sales →
Proofpoint Training for SMBs and MSPs: What the Vircom Delivery Model Includes
Organizations that purchase Proofpoint Security Awareness Training through a generic reseller receive the platform. Organizations that purchase through Vircom receive the platform plus decades of hands-on experience running security tools inside SMB and MSP environments, where limited IT bandwidth often determines whether a training program survives past its first six months.
Vircom has operated as a specialized email security provider since 1994 and has served as an official Proofpoint partner for MSPs and SMBs since 2017. That focus matters because the challenges of running a training program inside a 40-seat professional services firm are structurally different from the challenges facing an enterprise security team with dedicated headcount. Vircom’s support model, onboarding process, and tooling all reflect that SMB and MSP operating context.
Every Vircom customer gets access to the Vircom Portal, which includes over 100 automation tools and management functions at no additional cost. For MSPs, the Portal includes Vircom’s Security Awareness Managed Services option, which offloads ongoing campaign management and reporting to Vircom’s team. This frees MSP technicians from manually reconfiguring training programs across dozens of client accounts each month. The Portal also provides native integration with ConnectWise Manage and Autotask, so training status and alerts flow directly into the PSA tools MSPs already use for ticketing and client billing.
Vircom maintains a Net Promoter Score consistently above 50, against an industry benchmark of approximately 30, and the average customer tenure exceeds eight years. Free trials are available on all products at vircom.com/free-trial-all-products/, including Security Awareness Training, so organizations can run a real phishing simulation campaign before committing to a subscription.
Frequently Asked Questions About Proofpoint Security Awareness Training
What does Proofpoint training actually do, and how is it different from a compliance video?
Proofpoint Security Awareness Training runs on the DICE framework: Detect, Intervene, Change, Evaluate. It detects risky behavior or a simulated attack failure, intervenes with a teachable moment at the exact point of failure, changes behavior through short micro-learning, and evaluates progress over time. Compliance videos produce a knowledge spike that fades in weeks; Proofpoint ties instruction to the mistake itself, which is when learning sticks.
Does Proofpoint training cover vishing and smishing, or only email phishing?
Proofpoint Security Awareness Training includes curriculum covering vishing (voice-based social engineering delivered by phone or automated call), smishing (SMS-based phishing), and other non-email attack vectors in addition to email phishing simulations. This multi-channel coverage matters because attackers pivot across channels when one becomes less effective, and employees who have received only email phishing training remain fully vulnerable to a vishing caller who claims to be from IT. Proofpoint’s vishing training allows administrators to configure voice-based simulation scenarios and assign relevant learning modules to employees who interact with them. The full content library covers social engineering in all its forms, not just the version that arrives in the inbox.
How do I demonstrate training ROI to leadership, cyber insurers, or auditors?
The platform provides real-time reporting dashboards showing per-user risk scores, click rates on simulations over time, training completion rates, and trend data across multiple campaigns. This reporting generates the quantitative evidence leadership needs to evaluate program effectiveness without relying on self-reported employee confidence scores. For cyber insurance purposes, many underwriters now ask specifically about simulation-based training programs and expect to see documented evidence of declining click rates and increasing reporting rates over time. For compliance audits under frameworks that require documented security awareness training, the platform produces exportable records of completion by user, date, and module type.
See How Proofpoint Training Performs in Your Environment
Vircom has protected organizations across 40+ countries since 1994. As an official Proofpoint partner for MSPs and SMBs, Vircom provides Security Awareness Training with the operational tooling, managed services support, and PSA integrations that make it practical to run at scale, not just technically possible.
Request a free, personalized demo and see the simulation platform, reporting dashboards, and Vircom Portal in a live walk-through tailored to your organization or your MSP client base.
Want a walkthrough before you commit? See how Vircom’s Proofpoint Security Awareness Training handles phishing simulations, vishing and smishing coverage, and reporting for organizations like yours.
Get a Free Demo →
