Security Awareness Training

Security awareness training teaches the people in a business to spot a trick before they fall for it. Most break-ins do not start with clever code, but with an ordinary person clicking an ordinary looking link or paying an invoice that was never real. That makes this the part of security with nothing to do with software and everything to do with a normal working day.

Real training is short and often, so ten minutes every month beats three hours once a year. The long session is forgotten by the following week, while the short one lands because the last one is still fresh. Good sessions also use the messages your own staff actually receive, not examples invented in another country. A delivery notice, a password reset, or a note that seems to come from the owner asking for a quick transfer before a meeting teaches more than anything made up.

The other half is the fake phishing test. Someone sends the staff a harmless message that behaves like a real attack, then counts who clicked, and that number is not there to punish. Its only job is to show which teams need help and whether last month's session changed anything. Send one every few weeks and the click rate falls, but stop for six months and it climbs straight back.

The yearly slide deck fails for a simple reason, because it is watched, ticked off a list and forgotten. Nobody remembers a slide at four on a Thursday while a supplier is chasing payment, and that is exactly when the trick arrives. Habits survive where slides do not. Checking the address the mail really came from, or ringing the person back on a number you already had, is what stays.

What most companies get wrong is the hour after someone clicks. If staff expect to be shouted at they say nothing, so a quiet hour turns into a quiet week. Say plainly that reporting fast is right and nobody is blamed for it, then give one address or number and treat every report the same way. It helps if the systems your staff sign into record who did what and when, because a report can then be checked in minutes. When Linkysoft starts a cybersecurity project, we ask how long it took someone to report the last mistake, and that answer tells us more than any policy document. It is also why Linkysoft never sells training instead of the technical work, because the two only work together.