When an employee gets caught, the learning happens in the seconds that follow, not three weeks later. That is what remediation is for: closing the loop while the mistake is still fresh.
1️⃣ Two remediations, two different scopes
Riot offers two formats, and it matters not to confuse them.
👉 The remediation page
A web page made up of a few awareness slides, shown immediately after the employee is caught. Its scope is tied to the attack: it closes the loop on that specific attack, and only that one.
👉 The remediation course
A conversational course with Albert, on Slack, Teams, Google Chat or by email — automatically routed to the employee's usual channel. Its scope is tied to the employee: completing it marks as handled every attack they fell for over the last 3 months.
👍 Good to know: the remediation course does not require an Awareness module subscription. If you only use Simulation, you can still have your caught employees take a course.
⚠️ Important: these two remediations are independent. Completing the page only satisfies the follow-up tied to the campaign; completing the course only satisfies the remediation set at workspace level. If you enable both, the employee has to do both. This is the number one source of confusion on this topic.
👍 For callback attacks: remediation plays during the call itself. See Callback attacks.
2️⃣ The 3-month model
The remediation course works on a grouped catch-up basis: a single course is enough to clear the last three months. The goal is behaviour change, not punishment and it saves you from retraining the same people over and over.
⚠️ Important: the list of attacks covered is fixed at the moment the course is sent. If the employee gets caught after the course was sent, that new incident isn't covered by this completion: a new course will be needed.
3️⃣ Which channels remediation arrives through
There are five routes, and they don't all trigger under the same conditions.
The browser redirect to the remediation page, immediately after the employee is caught, if training follow-up is enabled on the campaign.
The follow-up email, with a link to the remediation page, if you have configured a follow-up report on the campaign.
The course with Albert, on the employee's usual channel, if remediation is enabled at workspace level.
The manager reminder, on the manager's own channel, if the employee was caught less than 3 months ago and hasn't completed their follow-up.
A task in the employee portal, for as long as the remediation course hasn't been completed.
💡 The most common combination: enable the remediation page immediately, then schedule Albert's course a week later. The employee gets the explanation on the day they were caught, and the deeper dive once they have had some distance.
4️⃣ The follow-up report: who receives it
A campaign's follow-up report can be configured in three ways.
Disabled: no debrief email is sent.
All employees: the debrief goes to the campaign's whole audience, including those who were not caught. The campaign becomes a collective learning moment, and being transparent about the exercise builds trust.
Vulnerable employees only: the debrief only goes to those who fell for it. A tighter loop, less noise.
5️⃣ Who receives Albert's course
A workspace setting determines the course audience:
All caught employees, including those who have already completed a remediation page or a previous course.
Only those who haven't completed their follow-up, which leaves out employees already up to date within the 3-month window.
👍 Good to know: if follow-up is enabled on the campaign and you choose "all caught employees" for the course, both the redirect and Albert's course will trigger. That is intended, but it means two prompts: shift the course by a week if you want to avoid the duplicate effect.
6️⃣ How manager reminders are prioritised
A manager receives one notification per team member, following this order of priority:
an overdue awareness course;
an uncompleted phishing follow-up;
a cheer-up message.
A team member who has both an overdue course and an uncompleted phishing follow-up will trigger the reminder about the overdue course; the phishing follow-up waits its turn. That is useful to know when a manager tells you they were never alerted about an incident.
7️⃣ Two limitations to know about
👉 The content of the remediation page can't be edited
The slides are designed by our experts to maximise retention, and cannot be edited. That is a deliberate choice: it guarantees consistent quality.
👉 A remediation that is started but not finished doesn't count
⚠️ Important: only completion is taken into account. An employee who stops on the second-to-last slide looks exactly like an employee who never opened the page: in your statistics, in manager reminders and in the portal. There is no partial-progress indicator.
That is worth bearing in mind before concluding that someone is ignoring their remediations: they may well have started without going all the way through.
Key takeaways
The remediation page handles one attack; the remediation course handles the employee over 3 months.
The two are independent: if both are enabled, the employee has to do both.
The course doesn't require an Awareness module subscription.
The list of attacks covered is fixed when the course is sent.
Only completion counts: no partial progress is reported.