Harmony Email and Collab - Disable Periodical Training Modules in Security Training

[RafaelSantiago]

Hey everyone,

I have a use case where a customer wants to use the Security Training add-on for HEC, but they do not want users to receive the Periodic Training Modules.

Basically, they only want users to receive phishing simulation emails. If they fail, they are then directed to a training module that they have to complete within a certain number of days.

I was looking through the documentation but could not find whether this is an option.

My best bets are either removing all training modules from the Periodic Training Modules configuration or trying to adjust the Training Module Cadence values, such as setting the interval between modules to 0.

Unfortunately, I am unable to test this in a lab environment.

Has anyone had this requirement before and been able to configure the Periodic Training Modules so that they are effectively disabled?

Regards,

Rafael Santiago

[jorgeluiznim · Accepted solution]

Hi @RafaelSantiago ,

I dug into the official Email Security (Harmony Email & Collaboration) Administration Guide — Chapter 20, "Security Awareness Training" — and the good news is your customer's exact use case is natively supported. The failure-triggered training and the periodic training modules are two independent parts of the same policy, so you're just looking at the wrong lever.

When you customize the SAT policy (Security Training > Policy > your rule), you configure, in order:

1. Simulation type — AI Adaptive Simulations, Use Custom Templates, or Do not perform simulation. → Keep this on (AI Adaptive or Custom).
2. "Automatically enroll users in follow-up training if they fail consecutive phishing simulations" — a Yes/No option, with a Consecutive failures dropdown and a Due in (days) field (default 7). → This is exactly your customer's requirement: a user who fails is automatically enrolled in the Phishing Awareness training and must complete it within the days you set. Set it to Yes, choose the failure threshold, and set Due in (days) to their window.
3. "Select training modules" — the periodic-module list (the block in your screenshot, driven by Training max frequency (days)). → This is the part to switch off: remove all modules from this list.

On your two ideas:

• ✅ Removing all modules from the periodic list is the correct lever. With no module selected there's nothing to send periodically — and nothing to send "on policy creation," as your screenshot notes.
• ⚠️ I'd avoid setting the interval (Training max frequency (days)) to 0. Periodic sending is driven by the module list, not the cadence — so as long as any module is selected, one is still sent regardless of the interval, and a cadence of 0 is undefined behaviour. Emptying the list is the deterministic way.

The key point that makes this work: per Ch. 20.15, the on-failure remedial training uses the Phishing Awareness module and is triggered by the simulation-failure flow itself, independent of the periodic "Select training modules" list. So an empty periodic list does not disable the failure-triggered training.

So the config for your customer:

• Simulation type: AI Adaptive (or Custom Templates)
• Automatically enroll on failure: Yes → Consecutive failures = 1 (or as desired) → Due in (days) = X
• Selected training modules (periodic): empty

One honest caveat, since neither of us can lab it: confirm the portal lets you save the policy with an empty periodic-module list. If the UI insists on at least one module, raise it with your SE/TAC rather than relying on interval = 0 — but per the documented flow, the failure-triggered training is the independent mechanism your customer needs.

Also worth flagging from the guide: SAT is supported only for Exchange Online (Microsoft 365) mailboxes.

Reference: Email Security Administration Guide, Chapter 20 — Security Awareness Training.

Hope this helps!

Best regards,
Jorge Dias Junior

[RafaelSantiago]

Hi Jorge,

Thanks for the reply.

We have been able to test this in production, and your indication was spot on. The platform allows us to remove all training modules from the Periodic Training Modules section and save the policy.

The simulated phishing emails are still sent normally and the training modules defined for users to do after they fail the simulation also remain avaiable.

I was also able to get Check Point TACs confirmation on this behaviour, so I'll ask them to add this to the official documentation.

TACs response:

"

The configuration you're looking for is supported within the existing policy settings. Here's how to achieve it:

To disable Periodic Training while keeping Simulation-Based Training active:

• Navigate to the Security Training policy configuration.
• Scroll to the bottom of the policy where the list of trainings is displayed.
• Remove all trainings from the list by clicking the X next to each one.
• Ensure the "Action on Failure – Follow-Up Training" option is selected. This is independent of the training list you just cleared — the system will automatically determine the appropriate training module to send based on the specific simulation the user failed.
• Save the policy.

With this configuration:

• Users will only receive phishing simulation emails as part of their regular workflow.
• If a user fails a simulation, they will automatically be directed to a relevant training module.
• You can configure the required completion timeframe for the follow-up training as needed.

No periodic training modules will be sent to users under this setup.

"

Regards,
Rafael Santiago