A caller introduces themselves as IT support. They know the company name and ask an employee to approve a notification on their phone because they are “fixing email access.” This is a sample training scenario. There is no suspicious attachment or badly written email. There is a decision to make under pressure.
Good security awareness training should prepare employees for decisions like this. Knowing the definition of phishing is not enough. People need to know how to verify an unusual request, when to stop and where to report a concern, including after they have made a mistake.
This guide is for people organizing cybersecurity training in businesses and institutions. It explains how to select the scope, use practical exercises and assess results without reducing the program to an attendance record.
What is security awareness, and what can it not replace?
Security awareness, also called cyber awareness, means understanding the threats associated with everyday work and knowing how to act safely. Training develops that understanding through examples and practice. A wider program also includes reminders, accessible instructions and support after the session.
NIST SP 800-50r1 describes this approach: learning should be managed as an evolving, evaluated program tailored to its audience, rather than a one-off event. The aim is to support appropriate behavior, not simply deliver information.
A trained employee does not replace technical safeguards. Email filtering, account protection, restricted permissions and incident handling remain necessary. The UK NCSC recommends layered defenses against phishing and cautions against expecting users to recognize every attack.
Connect education to a wider security plan. Our guide to securing a business or institution explains how to approach that work.
Before booking training, establish three things
Which situations do you need to practice? Gather examples from the team’s work: invoices, candidate documents, shared-file invitations or customer requests. Appropriately anonymized previous reports can help. Do not send the trainer real passwords, customer data or live malicious attachments.
How does reporting work? Identify the contact channel, the person or team receiving reports and an alternative when email or the employee’s account is unavailable. Assign an owner to the process. Training cannot fix a mailbox that nobody monitors.
Who is included? Consider new starters, shift workers and contractors with system access. Adapt the language and format to the audience. An employee who works mainly on a phone should practice with examples they can relate to that device.
Combine shared fundamentals with modules for finance, HR, customer service or management. Leadership preparation needs a separate scope. For organizations operating in Poland, see NIS2 and KSC training for boards and management.
What should employee security awareness training cover?
Suspicious messages and unusual requests
Do not limit exercises to email. Include text messages, collaboration tools, QR codes and phone calls. Ask participants to focus on the action requested: sharing information, changing a payment, installing an application or signing in to a service. Correct grammar and a familiar logo should not end the verification process.
Independent verification is particularly important for payment changes. Calling a number first supplied in the suspicious message does not provide that confirmation.
Account protection and safe sign-in
Practice using an approved password manager, separate passwords and multifactor authentication, or MFA. Participants should understand that they must not approve unexpected sign-in requests or share authentication codes with a caller. Demonstrate account recovery using the actual, approved support channel.
Documents, remote working and AI tools
Set an exercise about sharing a file: who should receive access, what permissions do they need and for how long? Also check whether employees know what to do after sending a document to the wrong person or losing a device.
For AI tools, explain which services the organization has approved and what data may be entered. Rather than giving a blanket prohibition, provide an approved way to complete the task. Examples include summarizing a document with fictional data or using an approved tool in line with information classification rules. A paid subscription alone should not determine whether a service is approved.
Reporting concerns, including after a mistake
Include a simple sequence in the employee instructions and practice it during the session:
- Stop the suspicious activity. Do not open more files or approve further requests.
- Report the concern promptly. Use the organization’s designated channel. Do not wait for certainty that an attack has occurred.
- Describe the facts. Explain what happened, when, which account or device is involved and what you have already done. Do not include passwords or authentication codes.
- Follow the response instructions. Preserve information needed for investigation. Do not delete evidence yourself or send suspicious files to colleagues to check.
This is a suggested approach for the security team to adapt, not a replacement for an incident response procedure. Actions affecting the device or account, including when isolation is required, need their own instructions.
Three exercises that go beyond definitions
The following situations are training examples, not accounts of client incidents. In each one, ask participants to explain their next action and the reason for it.
Finance: a supplier changes its bank details
A message refers to a familiar invoice and asks for payment to a new bank account. It contains no link or attachment. The participant must explain how they would verify the change using existing contact details and the payment approval process. Saying that the email looks legitimate does not complete the exercise.
IT support: a request to approve a sign-in
The caller claims that the account will be blocked unless the employee approves a notification. The task is to stop the attempt and check the request through the official support channel. In the second part, the participant learns that they have already approved it. They must now demonstrate how to report the situation promptly and accurately.
Document handling: a convenient but unapproved tool
An employee wants to summarize a document containing customer data in an AI service they have found online. The task is not to identify a malicious website. It is to check the data-handling rules and choose an approved way to complete the work. Where instructions are missing, record an action for the process owner rather than treating it as the participant’s failure.
An example 90-minute training agenda
The agenda below illustrates an introductory module. It is not a statutory minimum or a promise to prepare employees for every threat. For a broader scope, plan further modules rather than reducing the time for practice and questions.
| Duration | Topic | Participant task |
|---|---|---|
| 15 minutes | Threats relevant to the team’s work | Identify situations that require additional verification. |
| 25 minutes | Phishing and social engineering | Choose a safe response to a message or call. |
| 20 minutes | Accounts, documents and AI tools | Check a sign-in request or a proposed way of sharing information. |
| 20 minutes | Reporting suspicious events | Prepare a report using the internal instructions. |
| 10 minutes | Review and understanding check | Work through a short scenario and resolve questions. |
Discuss a scope like this when commissioning phishing and security awareness training for employees. Agree the participants’ starting point, examples and final materials before delivery.
How do you assess results, not just attendance?
Before training, ask the group to work through a short decision scenario. After the session, use a different task of comparable difficulty. Revisit one of the skills a few weeks later. Assess whether participants can perform the task, not merely recognize the correct answer in a quiz they have already seen.
Separate attendance from changed behavior. A report could track coverage of the intended audience, report quality, time from recognizing a concern to reporting it in an exercise, and completion of agreed improvements. Define the data source and calculation for each measure. More reports do not necessarily mean more attacks. They may reflect greater willingness to raise concerns.
For phishing simulations, account for message difficulty and the recipients’ context. The NIST Phish Scale describes a method for assessing phishing detection difficulty. Do not directly compare an easy test with a campaign closely tailored to a particular department’s work without acknowledging the difference.
Do not assume that every training format is effective. In a study by Rozema and Davis at one financial technology company, the interventions evaluated did not produce statistically significant improvements in click or reporting rates. That finding does not settle the effectiveness of every program, but it supports caution about promises and the need to evaluate your own approach.
Phishing simulations without shaming employees
A simulation does not have to be the first step. Start with a workshop scenario where appropriate. If the organization chooses a test campaign, agree its purpose, authorization, scope and use of results with IT, HR and the person responsible for data protection beforehand.
Do not collect real passwords or publish rankings of people who clicked. Avoid pretexts that exploit fears about employment or health. Plan a debrief, practical feedback and support for those who need it.
The NCSC emphasizes a culture in which people can report problems without fear of blame. That does not mean removing accountability. The purpose is to understand causes and improve the response, not discourage reporting.
What should happen after training?
Propose a short follow-up cycle to the program owner. In the first week, share a one-page guide with the actual reporting channel and arrange a catch-up for absentees. Over the following weeks, revisit one scenario and check whether the gaps identified in the workshop have been addressed.
Connect reminders to changes in work: a new tool, payment process, document-sharing rule or lessons from an incident. HR can coordinate participation, but the security team and process owners should maintain the rules. Management should follow them even when a request is urgent.
Employee security awareness training: common questions
Is the training suitable for people without IT knowledge?
An introductory program should be built around everyday tasks, not familiarity with technical vocabulary. Participants need to verify requests, handle information safely and report concerns. Advanced administrative tasks require separate training.
Does the session have to end with a quiz?
A quiz is not the only option. Use a decision scenario, a worked example or a practice incident report. Agree the assessment method before training. Check any organization-specific requirements for testing or documentation separately.
How much does training cost for a business or institution?
StartCyber pricing depends on participant numbers, format, duration, customization and materials. When comparing proposals, also check the trainer, opportunities for questions, participation records and recording terms. Rights to distribute the materials afterwards must be agreed rather than assumed.
Security awareness training with StartCyber
StartCyber delivers cybersecurity training for businesses and institutions online and in person. We adapt awareness training to participants’ roles, tools and the incident reporting process, using scenarios without shaming people for mistakes.
The proposal establishes customization, assessment and materials. Deliverables may include an employee guide, participation certificates and an aggregated summary for managers. A participation record documents the training. It is not independent certification that the entire organization is compliant.
Planning training for your team? Tell us the number and roles of participants, your sector or type of institution, preferred timing and delivery format. Include the situations you would like to practice. Request a tailored training program and quote. You do not need to prepare an agenda first.
This article is educational and does not replace legal advice on the obligations of a particular organization. Adapt the suggested program, exercises and documentation to applicable legislation, risk and internal requirements.
