By 
Fortinet already has instrumentation to measure observable behavior in awareness programs, but when matched against NIST SP 800-50 Rev. 1 and the Fortinet 2025 survey, many organizations still assess effectiveness with activity or perception signals. The operational gap is concrete: the platform can trigger phishing remediation and track clicks, responses, credential submissions, and completion, while the market still relies heavily on aggregated incidents, feedback, audits, and participation.
What emerges when NIST, Fortinet, and the 2025 survey are viewed together
Taken together, the sources do not say the same thing. NIST SP 800-50 Rev. 1 proposes measuring activity, learning, behavior, and outcomes, while Fortinet documentation shows that FortiSAT and FortiPhish can capture several of those signals at the user level. The Fortinet 2025 survey, by contrast, suggests that a significant part of the market still favors less direct indicators to prove effectiveness.
| Standard or program | What is measured | Concrete indicator | Signal type | Enabled action | Source |
|---|---|---|---|---|---|
| NIST SP 800-50 Rev. 1 | course attendance, behavior change per participant, end-of-course assessment, decrease in certain types of incidents or events, employee adoption of reporting tools | percentage of registered participants who attended, percentage of participants who changed a workplace behavior, such as reporting a suspicious phishing email, count of people who received a test phishing email and reported it correctly | activity, learning, behavior, and outcome | review and improve the program as needs change | NIST SP 800-50 Rev. 1 |
| Fortinet Security Awareness and Training / FortiSAT | completion and user performance, usage across areas, link clicks, QR code scans, credential submissions, overdue assignments, phishing risk score, high-risk users or groups | interactions such as link clicks, QR scans, and credential submissions, completion metrics, risk level history | activity and observable behavior | prioritize risk across people and teams, manage campaigns, export reports, assign remediation campaigns | Fortinet Documentation, FortiSAT, Security Awareness and Training |
| FortiPhish + Security Awareness and Training integration | phishing events per user and completion of associated training | when a user clicks a phishing link, replies to the message, or enters a username and password on a phishing page, count recipients who completed and did not complete the associated training | observable behavior with event-triggered remediation | automatically assign refresher or remediation training through remediation rules and associated campaigns | Fortinet Documentation, FortiPhish, Security Awareness and Training |
| Fortinet 2025 survey | reduction in incidents, employee feedback, security audits, participation, knowledge assessments, training completion, phishing simulation results, observed behavior improvements | incident reduction 53%, employee feedback 52%, audits 50%, participation 47%, knowledge assessments 46%, training completion 42%, phishing simulation results 40%, observed behavior improvements 38% | outcome, perception, activity, learning, and behavior | not specified | Fortinet 2025 Security Awareness and Training Global Research Report, research summary |
| Fortinet 2024-2025 phishing series | presence or use of phishing campaigns or phishing simulations in awareness programs | according to the 2024 Fortinet report, 98% said their programs include or will include phishing-related campaigns, according to the 2025 Fortinet report, use of phishing simulation campaigns fell from 86% in 2024 to 73% in 2025 | program practice adoption | not specified | Fortinet 2024 and Fortinet 2025 |
What does searching for security awareness training Fortinet really mean?
According to Fortinet documentation, Security Awareness and Training Service is a SaaS subscription for deploying and maintaining an awareness program inside a company, with a central dashboard to manage and track progress. According to Fortinet’s data sheet, administrators can monitor campaigns, completion, user performance, usage across organizations, and other results. Whalemate’s reading is that this is not just training content, but an operational base for managing evidence, segmentation, and tracking.
Does Fortinet measure activity or behavior?
The answer is that it can measure both, according to Fortinet documentation and the FortiSAT page. Fortinet documents activity metrics such as completion, performance, and overdue assignments, but also observable behavior signals such as link clicks, QR scans, message responses, and credential submissions. Whalemate’s reading is that the operational value appears when the program moves beyond completion logic and starts recording specific behaviors in response to controlled stimuli.
Where does NIST SP 800-50 Rev. 1 fit into this discussion?
NIST published SP 800-50 Rev. 1 on September 12, 2024, and that guidance proposes developing and managing a cybersecurity and privacy learning program throughout its full lifecycle. According to NIST SP 800-50 Rev. 1, metrics and evaluation methods should be used to review and improve the program as needs change. Whalemate’s reading is that NIST is not asking only for training delivery, but for the ability to evaluate it through different signals, from attendance to behavior change and outcomes.
Why is the drop in phishing simulations a relevant tension?
According to NIST SP 800-50 Rev. 1, one quantitative measure of behavior change is counting those who received a test phishing email and reported it correctly. According to the Fortinet 2025 report, only 40% measure effectiveness with phishing simulation results, and the use of phishing simulation campaigns fell from 86% in 2024 to 73% in 2025. Whalemate’s reading is that the market is using less of a practice that NIST recognizes as valid for observing behavior and that Fortinet needs for several of its most useful metrics.
What can Fortinet activate when it detects a phishing event?
According to Fortinet documentation, if Security Awareness and Training Service is integrated with FortiPhish, remediation rules can be created to assign training campaigns when a user clicks a phishing link, replies to the message, or enters a username and password on a simulated page. According to the FortiPhish data sheet, refresher or remediation training can also be assigned automatically. Whalemate’s reading is that the key decision is not just to simulate, but to close the loop between event, intervention, and new measurement.
