Knowledge that's still there on Tuesday.
When we were responsible for security ourselves, we counted how many people had clicked through this year's course. It was the only thing we could count. The figure looked good in the report. It said nothing about what people did when the email actually arrived.
Robustium is built on what we learned. Each lesson is a short situation from work. The employee makes a choice and gets an explanation. The week after, the same topic comes back in a new situation. Security is a habit, and habits are built in small, repeated steps.
Phishing tests, in numbers.
What the research supports.
Every lesson uses four principles with strong support in research.
Explanation
10×the effectAn explanation has ten times the effect of right or wrong alone.
Every answer option has its own explanation.
Practical advice
2,024peopleMessages about what to do worked better than threats, and the threat added nothing.
Every lesson ends with one thing to do.
Control group
1.7percentage pointsThat is what the training added. The difficulty of the emails moved the share who clicked between 1.8 and 30.8%.
We measure against a group that has not started.
Mistakes corrected at once
A mistake that is corrected at once teaches more than reading without errors.
The wrong options are mistakes that happen in real life.
Subtitles
Subtitles help most for people working in a second language.
Speech and short text, nothing decorative.
Sources
- Latimier et al. 2021: spaced repetition.
- Yang et al. 2021: answering instead of rereading, 48,478 learners.
- Van der Kleij et al. 2015: feedback that explains.
- Brunmair & Richter 2019: mixed situations, 59 studies.
- Ho et al. 2025: 19,789 employees, ten test campaigns over eight months.
- van Bavel et al. 2019: experiments with 2,024 people in five EU countries, including Sweden.
- Metcalfe 2017: learning from corrected mistakes.
- Noetel et al. 2022: speech, text and pictures in teaching.
All findings.
From training that barely works, to unions stopping tests with fake bonuses, to one in three keeping quiet about a safety risk. And in production, more than IT is at stake.
What the method does.
- The aim is staff who get better at defending themselves and the organisation. The method builds on what controlled studies in healthcare and aviation found makes training show up in the work: short exercises with feedback, repeated at intervals, in situations from the job.
- Evidence for management's duties under the Swedish Cybersecurity Act: every completed training is logged, so you can show who has done what.
How we measure.
We follow how many people take the lessons and how well the answers hold up in new situations over time. We compare the results with a group that has not started yet. That shows what the training itself does.
Nano, micro or a full course?
Three ways to set up training and what usually sets them apart.
| Feature |  Nano trainingRobustium's short lessons |
 MicrolearningShort modules |
 Traditional courseE-learning course or training day |
|---|---|---|---|
| Length | 1–3 minutes, question included | 5–15 minutes | 30 minutes to a full day |
| How often | Every week | About once a month | Once a year |
| Making a choice | In every lesson, in a new situation | Sometimes | Usually in a final test |
| Repetition | The week after: a new scenario on the training you did | Rarely built in | Next year |
| Best for | Between meetings, at shift handover, on a phone | At the desk | When everyone can set aside time together |
| Often measured as | How many take the lessons and how well the answers hold up over time | Completion | Completion and final test |