CASE STUDY

The Approach

What does a cyber learning experience that employees actually want to complete look like?

When the bank started evaluating alternatives, the brief was simple: less admin, better engagement, data that means something. What they found with CLX was something more fundamental — a different model of what security awareness training is supposed to do.

Most security awareness platforms are built on a content library and a delivery mechanism. You choose the content, assign it, track who completes it. The platform records the activity. The admin chases the gap. The cycle repeats.

CLX is built differently. The curriculum is structured around five competency pillars — the dimensions of security behavior that actually matter in a financial services environment: from recognizing social engineering to understanding data handling, access management, and the everyday decisions that separate a secure organization from a vulnerable one. Each employee's learning journey is mapped to their role and their starting point. The system determines what gets delivered and when. The admin doesn't choose, assign, or manage the content cadence.

The content itself was a departure from what staff had experienced before. Monthly learning moments of around 10 minutes — short, specific, and built to be genuinely engaging rather than endured. No more hour-long modules blocked out of calendars. Instead, a regular rhythm that fitted around real working days, in a format that didn't feel like a regulatory obligation.

The launch mattered too. Rather than dropping a new platform into the same old cycle, the team sent a deliberate ahead-of-time communication: this is different, here's what to expect, here's why it's worth your time. Skepticism was real — staff had learned to dread annual training, and changing that expectation took intentional effort.

Month one was slow. That was expected. But the employees who logged in first had a different reaction to the training they'd been dreading. They came back. Month on month, completion momentum built — not because someone was chasing it, but because the experience itself had changed.

The Results

Within 90 days of launch, 85% of the workforce had completed their first learning cycle — without a single manual chase. By the end of the first program year, sustained completion sat above 90%, consistently, month on month.

For a bank that had previously spent six months chasing a 40% on-time rate, that number represents a structural change — not a one-time effort.

The admin's working week changed too. The 8 hours a week she had spent chasing completions — for up to six months after each assignment window — dropped to 2 hours a month. Not because the job got easier. Because most of it stopped being her job. CLX handled the delivery, the sequencing, and the follow-up. What remained was the work that actually required human judgment.

Those hours went somewhere useful. For the first time, the security awareness manager had capacity to build proper management reports, communicate risk in terms the business understood, and have the conversations with leadership that a strategic program makes possible.

The data changed too. For the first time, the team had visibility into competency across the five pillars — not just who had clicked the module, but who was demonstrating secure behaviors and where the gaps were. Departments with lower competency scores could be targeted with reinforcement content. High-risk roles were identifiable and actionable. The program moved from completion tracking to genuine risk intelligence.

At the next management review, the security team didn't present a completion percentage. They presented a picture of the organization's human risk posture — by department, by role, by behavior — and a plan for where to focus next.

“We went from one number — completion rate — to actually understanding which parts of the business were exposed and why. That changed the conversation completely.”

Security Awareness Manager, US Regional Bank