Knowledge that's still there on Tuesday.

When we were responsible for security ourselves, we counted how many people had clicked through this year's course. It was the only thing we could count. The figure looked good in the report. It said nothing about what people did when the email actually arrived.

Robustium is built on what we learned. Each lesson is a short situation from work. The employee makes a choice and gets an explanation. A few days later the same topic comes back in a new situation. Security is a habit, and habits are built in small, repeated steps.

Nano, micro or a full course?

Three ways to set up training and what usually sets them apart.

Feature	Nano trainingRobustium's short lessons	MicrolearningShort modules	Traditional courseE-learning course or training day
Length	1–3 minutes, question included	5–15 minutes	30 minutes to a full day
How often	Every week	About once a month	Once a year
Making a choice	In every lesson, in a new situation	Sometimes	Usually in a final test
Repetition	A new question after a few days	Rarely built in	Next year
Best for	Between meetings, at shift handover, on a phone	At the desk	When everyone can set aside time together
Often measured as	How many take the lessons and how well the answers hold up over time	Completion	Completion and final test

What the research supports.

Every lesson uses four principles with strong support in research.

How much the principles helpAccording to four large meta-analyses

Spaced repetition0.74

Answering instead of rereading0.50

Feedback that explains0.49

Mixed situations0.42

Explanation

10×the effect

An explanation has ten times the effect of right or wrong alone.

Every answer option has its own explanation.

Practical advice

2,024people

Messages about what to do worked better than threats, and the threat added nothing.

Every lesson ends with one thing to do.

Control group

1.7percentage points

That is what the training added. The difficulty of the emails moved the share who clicked between 1.8 and 30.8%.

We measure against a group that has not started.

Mistakes corrected at once

A mistake that is corrected at once teaches more than reading without errors.

The wrong options are mistakes that happen in real life.

Subtitles

Subtitles help most for people working in a second language.

Speech and short text, nothing decorative.

Sources

Latimier et al. 2021: spaced repetition.
Yang et al. 2021: answering instead of rereading, 48,478 learners.
Van der Kleij et al. 2015: feedback that explains.
Brunmair & Richter 2019: mixed situations, 59 studies.
Ho et al. 2025: 19,789 employees, ten test campaigns over eight months.
van Bavel et al. 2019: experiments with 2,024 people in five EU countries, including Sweden.
Metcalfe 2017: learning from corrected mistakes.
Noetel et al. 2022: speech, text and pictures in teaching.

What we don't claim.

That Robustium reduces clicks, incidents or risk by a certain percentage. A figure like that requires our own controlled data. The largest field studies of security training show small effects.
That training alone makes you compliant with the Swedish Cybersecurity Act.

How we measure.

We follow how many people take the lessons and how well the answers hold up in new situations over time. We compare the results with a group that has not started yet. That shows what the training itself does.