ExamopotamiaWhy run a security awareness quiz?
Firewalls and antivirus can't stop an employee who types their password into a fake login page. Awareness training helps, but only if people remember it. A short quiz after training, and again a few months later, measures how much people retained, shows which teams need more support, and gives you evidence for frameworks like ISO 27001, SOC 2 and Cyber Essentials.
What this template covers
- Phishing: recognising urgent threats, spoofed senders and unexpected attachments.
- Passwords: why long passphrases beat short "complex" passwords.
- Multi-factor authentication: what MFA is and why it matters.
- Physical security: what to do with an unknown USB stick.
How to run it well
Treat it as training, not a trap. Turn on the answer review so each person sees the right answer and a short explanation straight after submitting. That reinforces the lesson while it's fresh. Set a pass mark of around 80% and allow retakes. The aim is that everyone ends up knowing the material, not that some people fail.
Run it on a schedule: at onboarding, then every quarter with a few new questions. Shuffle questions and options so colleagues can't pass answers around. Compare per-question results over time. If phishing questions keep scoring low, that is where your next training session should go.
Who this test is for
Use it for every employee, not just IT. Finance and HR teams are favourite phishing targets, and new starters are often the easiest to fool because they don't yet know what normal internal emails look like. Run it during onboarding, after a phishing simulation, and before audits that ask for proof of awareness training.
Make it yours
Add your own reporting process (who to email, which button to press), real examples of phishing attempts your company has received, and your policies on personal devices. The AI generator can draft new questions on topics like social engineering, public Wi-Fi or ransomware. Staff take the quiz from a link with no account needed.