Cybersecurity awareness training can be useful, but it gets treated like a checkbox far too often. Someone completes a twenty-minute course once a year, the business records it, and everyone moves on.
The better approach is simpler: give team members enough knowledge to recognise the situations they are likely to face, make the safe action easy, and make sure they know who to tell when something does not look right.
Training also should not be used as an excuse for weak security. Team members awareness matters, but it needs to sit alongside properly configured MFA, email protection, managed devices, sensible access controls and monitoring.
What should cybersecurity awareness training actually cover?
For most small and medium businesses, the useful topics are not particularly complicated. Team members should understand the common ways attackers try to get money, credentials or access, and what the business expects them to do when they see something suspicious.
Photo by Campaign Creators via Unsplash.
Suspicious emails and messages
Phishing is not just badly written spam. A convincing message might look like Microsoft, a supplier, a client or somebody inside the business. Team members should be wary of unexpected links, login prompts, attachments, urgent payment requests and messages that try to push them around the normal process.
The important habit is not memorising a list of warning signs. It is being comfortable stopping and checking when something does not feel right.
Payment and bank-detail changes
Any request to change bank details or make an unusual payment deserves a separate verification step. Team members should know the business process and should verify the request using contact details they already trust, rather than replying to the same email or calling a number supplied in it.
This is one of those areas where a simple business process can do as much useful work as another security product.
MFA prompts and account sign-ins
If somebody receives an MFA prompt they did not initiate, the answer is not to approve it just to make it disappear. Team members should know that unexpected prompts can be a sign that somebody already has the password and is trying to get through the second step.
For higher-risk accounts, the business should also look at stronger phishing-resistant authentication rather than relying only on team members spotting every bad login attempt.
Passwords, shared accounts and access
Team members should not be sharing passwords around the office or reusing the same account between several people because it is convenient. People should normally sign in as themselves, and shared business resources should be set up using the sharing features provided by the system rather than one common login.
That makes MFA, access reviews, offboarding and incident investigation much easier to manage.
Make reporting easy
A team member who reports a suspicious email quickly can save a lot of time. A team member who clicks something and then hides it because they are worried about getting in trouble can make the problem much worse.
The reporting process should therefore be obvious. Team members should know whether to forward the message, use a reporting button, call the Service Desk or raise a ticket. If they entered a password, approved an MFA prompt or opened a suspicious attachment, they should know to say that clearly rather than quietly hoping nothing happens.
The aim is fast reporting, not catching people out.
Training should be regular, but it does not need to become a monthly lecture
ASD’s small-business guidance recommends regular security education, including making it part of induction for new team members and refreshing it over time. That makes sense. Threats change, team members change and people forget things they only hear once.
That does not mean everyone needs another hour-long presentation every month. Short refreshers, relevant examples, simple phishing simulations and quick reminders after a real incident can be more useful than repeatedly sending the same generic course.
Photo by Ninthgrid via Unsplash.
Phishing simulations are useful when they teach something
A phishing simulation can show whether team members recognise suspicious messages and whether they know how to report them. It can also show where the process itself needs work.
The useful question is not simply who clicked. If nobody knows where the report button is, if the simulated message looked nothing like the threats the business receives, or if the exercise is mainly being used to embarrass people, it is not achieving much.
Better simulations reinforce the right behaviour and help the business identify where another control would reduce the risk further.
Different roles may need different training
The person processing supplier invoices faces a different risk from the person administering Microsoft 365. Managers, finance team members and people with privileged access may need additional guidance because a compromised account in those roles can cause more damage.
ASD’s current personnel-security guidance takes the same approach for higher-risk and privileged users: general awareness training is important, but some roles need training tailored to the access and responsibilities they hold.
Training is one layer, not the whole security plan
People will make mistakes. The security design should assume that occasionally somebody will click the wrong link, open the wrong attachment or respond to a convincing request.
That is why awareness training should be backed by email filtering, MFA, endpoint protection, patching, limited privileges, backups and useful monitoring. The goal is to make a mistake less likely, then limit what happens if one still occurs.
What good awareness looks like
A good result is not a certificate showing everyone completed a course. It is a team that pauses before an unusual payment, questions an unexpected login prompt, reports suspicious messages quickly and knows who to contact when something has gone wrong.
If you are reviewing security awareness, it is worth reviewing the technical controls at the same time. Our phishing, MFA fatigue and account takeover guide explains some of the common attack paths, while the Essential Eight guide covers a broader Australian security baseline.
Q10 can help businesses put the training, security controls and reporting process around this so team members are supported rather than expected to be the entire security system themselves. See our cybersecurity services or talk to Q10.
Featured image: Annie Spratt via Unsplash.