CISA Phishing Awareness Training Guidance: 2026 MSP Guide
Align phishing awareness training with CISA guidance in 2026: cadence, reporting, evidence, and MFA steps MSPs can roll out across every client fast now.
DefendWise
DefendWise
CISA's phishing guidance treats phishing as an attack cycle you can interrupt at phase one, not a once-a-year training checkbox — and most MSP-delivered security awareness training programs are still built around the checkbox model.
TL;DR
- CISA phishing awareness training guidance frames phishing as a stoppable attack cycle, not annual compliance theater.
- Align cadence, reporting, and MFA messaging to CISA's phase-one framing — DefendWise packages this by default. Buy.
- Per-seat SAT tools punish MSPs for matching CISA's recommended testing frequency; flat-fee removes that penalty.
- Evidence trails matter more than pass rates when a client cites CISA phishing awareness training guidance to an auditor.
Why this matters
CISA published its phishing guidance framework to push organizations away from single annual trainings and toward continuous testing, fast reporting, and layered technical controls. Clients increasingly ask MSPs to show how their security awareness training maps to that guidance, especially when a cyber insurance renewal or a compliance audit is on the calendar in 2026.
The problem isn't understanding CISA's guidance. It's operationalizing it across dozens of subclients without the admin load exploding and without per-seat pricing punishing you for testing more often than the license allows. That's the gap this guide closes.
What you'll need
- A phishing simulation and security awareness training platform that supports unlimited campaign frequency without seat-based cost penalties
- Access to CISA's published phishing guidance and Cyber Essentials materials for your client-facing documentation
- A reporting mechanism end users can trigger in one click (button, forwarded address, or plugin)
- A baseline click-rate and report-rate benchmark per subclient, captured before you change anything
- A documented incident response path for anything a user reports as suspicious
- 30-60 minutes per subclient to configure cadence and reporting rules
Anti-phishing software for MSPs covers the platform-selection criteria in more depth if you haven't locked in a tool yet.
The steps
1. Pull CISA's current phishing guidance and translate it into a client-facing summary
CISA's guidance centers on stopping phishing at the earliest phase of the attack cycle — before a click turns into a credential harvest or malware execution. Read the guidance once, then rewrite it into three or four sentences your account managers can repeat to any client without sounding like they're quoting a federal PDF.
This matters because clients don't need the government's language, they need to know what changes in their environment. Expected outcome: a one-page internal brief that maps CISA's phases (reconnaissance, delivery, exploitation, reporting) to features you already run.
Common mistake: copying CISA's document into a client deliverable verbatim. It reads as compliance theater instead of an actual security posture.
2. Set testing cadence to match CISA's attack-cycle framing, not an annual audit calendar
CISA's phishing guidance assumes phishing is continuous, so testing has to be continuous too. Move every subclient off a single annual simulation and onto rotating monthly or bi-monthly campaigns with varied lure types — invoice fraud, credential harvest, MFA fatigue, and QR-code lures are the four categories worth rotating through in 2026.
Document the cadence per client in writing. Expected outcome: every subclient has a written testing calendar, not a verbal agreement.
Common mistake: running the same lure template every cycle. Click rates plateau and stop reflecting real susceptibility.
3. Build a one-click reporting workflow CISA's guidance explicitly calls for
CISA's phase-one framing depends on humans reporting fast, not just avoiding the click. Set up a report-phishing button in the client's email client (Outlook or Gmail add-in) so a suspicious email reaches your triage queue in seconds, not after a Slack message chain.
Measure report rate as a separate metric from click rate — a client with a 4% click rate and a 65% report rate is in a materially different risk posture than one with a 4% click rate and a 12% report rate. Expected outcome: a report-rate baseline for every subclient inside 30 days of turning the button on.
Common mistake: tracking click rate only. CISA's guidance treats reporting as the control that actually shortens attacker dwell time.
4. Layer MFA and technical control messaging into the training itself
CISA's guidance doesn't stop at behavior — it pairs training with phishing-resistant MFA as a technical backstop. Your security awareness training content should explicitly tell users why MFA exists and what to do when an MFA push notification looks wrong (MFA fatigue attacks spiked through 2025 and remain a live category in 2026).
This closes the loop between not clicking and knowing what still protects you if you do. Expected outcome: every training module references at least one technical control the client already has deployed.
Common mistake: treating training and MFA as two separate workstreams owned by different teams. CISA's guidance treats them as one control.
5. Document every campaign as evidence, not just a completion log
When a client cites CISA phishing awareness training guidance to a cyber insurer or an auditor, they need dated campaign records, click-rate trends, and report-rate trends — not a certificate of completion. Export campaign data monthly and store it per subclient in a format your account team can hand over in under five minutes.
Expected outcome: a standing evidence folder per client, updated automatically, not assembled the week before renewal.
Common mistake: generating evidence only when a client asks for it. That's the scramble security awareness training for cyber insurance is built to prevent.
Deploy CISA-aligned training in one afternoon
One flat fee, unlimited seats across every subclient — no per-seat penalty for testing more often.
6. Roll cadence and reporting out to every subclient without seat-count friction
The fastest way an MSP program drifts from CISA's guidance is cost. Per-seat licensing makes monthly testing across 40 subclients expensive fast, so the natural response is to test less often — which directly contradicts CISA's continuous-testing framing. DefendWise runs on one flat fee of $399 a month for unlimited seats, so cadence decisions get made on security merit, not license math.
Expected outcome: the same testing frequency across a 20-seat client and a 2,000-seat client, with no internal debate about cost.
Common mistake: scaling cadence down as subclients grow, exactly when CISA's guidance says exposure is rising.
7. Escalate anything reported as CISA's phase-one guidance recommends
A reported email that turns out to be a real phishing attempt needs a documented response path: who gets notified, what gets blocked, and how fast. Build this before you need it, not during an active incident.
Expected outcome: a written escalation path referenced in the client's onboarding packet, reviewed at least once a year.
Common mistake: no defined owner for triage, so reported emails sit unreviewed for days.
Troubleshooting
- Click rates aren't dropping after six months of campaigns — check lure variety first. Repeating templates trains users to recognize your simulations, not real phishing.
- Report rate is flat while click rate improves — the reporting button is likely buried or requires too many steps. One click, not three.
- A client pushes back on monthly cadence as too much — reframe using CISA's own attack-cycle language: continuous testing matches continuous attacker activity.
- Evidence exports don't match what an auditor asks for — standardize the export format before audit season, not during it.
- New hires skip their first simulation — anchor phishing training to day-one onboarding, not a quarterly batch cycle.
- Subclients ask why a competitor's per-seat tool tests less often — that's the seat-count penalty CISA's guidance doesn't account for, and it's the exact gap flat-fee pricing closes.
Tools and resources
- CISA's published phishing guidance and Cyber Essentials materials (external, free)
- How to choose phishing simulation software for your MSP clients for platform evaluation criteria
- How to benchmark employee phishing susceptibility rates for setting per-client baselines
- How to report a phishing email to your IT team as an end-user-facing reference
- A per-client evidence archive, exported monthly
FAQ
What is CISA's phishing awareness training guidance based on?
CISA's guidance frames phishing as an attack cycle and recommends stopping it at phase one through continuous testing, fast user reporting, and layered technical controls like MFA. It moves organizations away from single annual trainings toward ongoing simulation programs.
How often should phishing simulations run to align with CISA guidance?
Monthly or bi-monthly campaigns with rotating lure types match CISA's continuous-testing framing better than a single annual test. Quarterly is the minimum floor most MSPs use in 2026 for lower-risk clients.
Does CISA guidance require a specific phishing simulation tool?
No. CISA's guidance describes outcomes — continuous testing, fast reporting, MFA layering — not a specific vendor. Any platform that supports those outcomes without seat-count cost penalties satisfies the intent.
How much does CISA-aligned security awareness training cost for an MSP?
Costs vary by platform and pricing model. Per-seat tools scale cost with headcount, which discourages the testing frequency CISA recommends; flat-fee platforms like DefendWise run $399 a month for unlimited seats regardless of client size.
What's the difference between click rate and report rate in CISA's framing?
Click rate measures how many users fall for a simulated phish; report rate measures how many flag it to IT. CISA's phase-one guidance treats report rate as the more important metric because it shortens how long an attacker stays undetected.
Do MSPs need to document CISA alignment for cyber insurance renewals?
Insurers increasingly ask for dated campaign records and trend data, not just a training completion certificate. A standing evidence archive per client satisfies most 2026 renewal questionnaires without a last-minute document scramble.
Is MFA part of CISA's phishing guidance or a separate requirement?
CISA pairs training with phishing-resistant MFA as a technical backstop within the same guidance, not as a separate workstream. Training should explain what MFA does and how to spot a suspicious push notification.
One last thing
The MSPs that struggle most with CISA phishing awareness training guidance aren't confused about the guidance itself — they're stuck on a pricing model that makes following it expensive. Test monthly instead of annually across 40 clients under per-seat licensing and the invoice moves fast. Flat-fee removes that math entirely, which is the actual reason DefendWise built the model around $399 a month for unlimited seats instead of a per-user rate.