Systems and techniques for security content delivery based on tagged personas are described herein. User data may be obtained for a user of a network file system. Attributes may be extracted from the user data to establish a user persona. Event data may be obtained for a security event experienced by the network file system. The security event may be associated with the user. A set of available remediation content items may be identified using the event data. A content item may be selected from the set of remediation content items using the user persona. A transmission medium may be determined for transmission of the content item to the user using the user persona. The content item may be transmitted to the user via the transmission medium.