Empowering Cybersecurity Excellence: The Trellix Journey to 90%+ Customer Training Satisfaction

Click here to download the full case study

Let’s dive into Trellix’s journey and see how they achieved an outstanding customer training satisfaction rate of over 90%. Their commitment to exceptional training delivery and the use of NetExam LMS resulted in improved customer retention, higher Net Promoter Scores (NPS), and significant savings in support costs.

About Trellix (formerly McAfee)

Founded in 2022, Trellix (formerly McAfee Enterprise and FireEye) is a global company redefining the future of cybersecurity and soulful work. The company’s open and native extended detection and response (XDR) platform helps organizations confronted by today’s most advanced threats gain confidence in the protection and resilience of their operations.

The challenge they faced

80% of the Fortune 100 trust Trellix’s products and services to secure them from cyber threats – and understandably, given the immense complexity and ever-changing nature of cybersecurity, these customers have extensive training needs.

Trellix’s 40,000+ customers worldwide have high expectations for their digital training experiences. When the pandemic hit, Trellix could no longer focus on live training. And Trellix found many of its customers prefer to purchase “credits” for their learners to spend on training rather than using credit cards, so Trellix was in need of an advanced solution to support a more corporate customer-friendly way to engage with the product education program.

Trellix partnered with NetExam, an LMS designed specifically for customer and partner education, for its customer training platform. NetExam gave Trellix the ability to easily tailor and deliver training to its diverse global customer audience.

For instance, the NetExam LMS allows customer organizations to purchase credits for their employees, who can browse, select, and purchase relevant training courses within the platform. Trellix also issues training vouchers, which can be redeemed by customers on the NetExam platform to take advantage of special offers.

How they solved it

Systems training can often be dry, so the design of Trellix’s customer training is especially important. It’s an important revenue stream for the Trellix L&D department, so it’s vital that customers are happy with the offerings.

Trellix’s instructor-led training (ILT) program incorporates hands-on labs to allow students to practice and incorporate learned concepts and approaches reinforcing the training. Trellix delivers both public classes and private training for customers and students receive their guides and lab guides to reference.

Trellix’s training content is designed for security engineers and security operations center (SOC) analysts. Content covers topics such as installing, configuring, and setting up Trellix’s products for engineers, and incident response and threat hunting for SOCs.

Additionally, Trellix offers product-agnostic training, such as industry standards and how to find and remove malware from devices.

How their training was impacted by the pandemic

Prior to the COVID-19 pandemic, much of Trellix’s offering was delivered face-to-face via a comprehensive ILT program. However, when the global lockdown hit, much of its training switched to virtual delivery overnight.

In 2020, almost 100% of training was delivered via Virtual ILT (VILT). But in 2024, demand for in-person ILT was growing again, so 10% of the live training program is now delivered on-site.

The pandemic was a catalyst for a whole new design of Trellix’s customer training program. Pre-pandemic, Trellix used to ship out laptops and offer training at physical venues. While it was popular with customers, this was an expensive way to deliver training, so the pandemic created a challenge: to redesign the program overnight in a way that would still resonate with customers.

Moving to a digital-first design

The solution was redesigning the program to lead with VILT, which is run via Microsoft Teams or Google Meet in virtual labs. This digital-first design maintains the popular live, instructor-led aspect of the original program, but saves Trellix and the end customers a lot of time and money.

*Grid view of Virtual Instructor-Led Training*

A comprehensive blended learning solution

During Covid, Trellix expanded their training mix from live training components to the following:

Elearning
System simulations
Videos
Knowledge checks
Quizzes to assess comprehension
Various digital resources and PDFs

This blended mix allows customers to work through training material at their own pace and consume content as and when they need it. This ensures the training design is as flexible as possible to suit a wide range of learning preferences and schedules of busy tech experts worldwide.

The main difference between their ILT/VILT and eLearning is that with ILT/VILT, the training goes deeper into concepts by using hands-on labs of Trellix products.

The eLearning is typically composed of videos and activities that allow users to take it on demand.

Unique blends for each customer

The typical split between ILT/VILT and self-paced elearning is unique for each customer and depends on their needs. The self-paced elearning courses are typically entry level to introduce a student to products and concepts, while instructor-led training focuses on more advanced concepts about the Trellix product, and security analyst use cases.

By offering a step-up path for users to start learning about Trellix products and dive deeper into training by having a subject matter expert explain the content and show best practices, Trellix caters to all audiences.

The platform also makes it easy to schedule and provides options for students to select whatever works best for them.

Endless options for customer training

*Easy checkout screen in the purchase process, showing the ability to combine up to three voucher codes thanks to NetExam LMS customizations*

Trellix needed a platform flexible enough to give customers potentially endless options in self-paced learning or ILT/VILT, and at the same time link to entitlements through “Flex Credits.”

Trellix learned that there are very few LMS products available in the market that provide the flexibility of using credits/vouchers the way NetExam does.

Trellix Thrive, Trellix’s innovative customer success product, connects support, education, and professional services for any Trellix solution, providing customers with the tools needed to drive efficiencies.

Trellix Flex Credits are customizable credits that can be applied to proactive services such as penetration testing, purple teaming, and advanced threat intelligence services, as well as an XDR assessment, product tune-up, or health watch to ensure the technology is operating at peak efficiency.

The innovative structure provides customers the flexibility to pivot consumption as business needs evolve. Trellix Thrive and the Flex Credit offering is unique to Trellix, and enables users to self-register for public offerings, reducing overall admin time to save money and increase customer satisfaction.

How they delivered the training

ILT courses, VILT, self-paced elearning, and digital resources, including videos, simulations, tests, and quizzes, are accessed via the Trellix catalog storefront, which is available to all customers.

*Trellix customer training portal catalog page*

In particular, customer feedback shows that they particularly enjoy the ILT and VILT elements of the program, as they include engaging labs, rather than “click next” simulations. The lab environments use the actual product, so each learner gets their own sandbox to play around with the product, diverge from the specific training, and safely explore without taking any risks in the live product. They can then ask a live instructor how to carry out specific tasks, giving them the interactivity they enjoy.

For gamification, one of the most successful elements of Trellix’s customer training program is its “Capture the Flag” events, where learners compete to earn points for solving problems before other participants. This requires customers to complete training (either via ILT/VILT/elearning) prior to the event, before putting their skills to the test in an engaging live challenge.

Upon completion of a course, Trellix provides a certificate of completion, so learners can log in and track their consumption of training. This also provides customer learners with evidence of training, which can be used in the workplace as proof of skills and competencies.

*Sample certificate of completion, which customers can use to prove completion of training and competency as a user of Trellix’s products*

The impact of the training

Trellix incorporates evaluation surveys into its customer training for NPS (Net Promoter Score) measurements, as well as to understand any customer issues and questions. These surveys have revealed customer satisfaction of over 90% for all Trellix training, with the ILT and VILT components being particularly popular.

There is also very positive feedback on the courses, instructors, practical labs, and customer delivery.

Trellix also learned that customers who consume their training have:

Better Net Promoter Scores (NPS)
Higher levels of stickiness
Fewer support tickets
Greater customer retention (particularly among enterprise clients)
Heightened levels of engagement

This is a testament to the quality of the training product and a great user experience, with customer comments such as “This is the best training I’ve ever taken” regularly appearing in engagement surveys.

Additional customer feedback, relating to their favorite aspects of the training, includes:

“The labs are the main reason for my score. I had an opportunity to work in a real, well-prepared environment with clearly made, step by step instructions on how to configure ePO and DLP.”
“I would recommend this Trellix training because of all the content covered and the good instructors.”
“[I liked] the quality of the instruction because of their knowledge on the platform, and because of the empathy of the instructor.”

Elearning content on the customer training platform has reached a high of 20,000 users a year (during the pandemic), but it has since settled to around 3,000 users a year.

There are usually a further 3,000 learners accessing ILT and VILT content a year, with around 90% of these accessing VILT and 10% choosing ILT, though the ILT demand is growing since pandemic restrictions have eased – particularly in Europe.

The flexibility of NetExam gives Trellix the freedom to cater to customer preferences in each geographical region, ensuring customers get the training they want and how they want it.

Other NetExam case studies that you might be interested in

Inside Royal Canin’s Training Program for Pet Care Experts

Empowering AT&T Partners – Certification Tracking with NetExam

Transforming Travel Agent Training: Sabre’s Success with the NetExam LMS

About the Author

Gordon Johnson brings over thirty years of experience in the customer training industry, having worked with various high-tech companies, training firms, and learning technology providers like NetExam.