Security awareness training topics: the 8 every team needs

1. Why security is everyone's job (5 min)
   • Most attacks start with a person: an email, a call, a message or a login page.
   • Attackers go after money, data and access, and small companies are targets too.
   • 2 more points, a do and a don't, and quiz questions in the kit
2. Spotting phishing (10 min)
   • Urgency or pressure: 'act now', 'account suspended', 'CEO needs this today'.
   • Sender or link that doesn't match: check the real address and hover over links before clicking.
   • 3 more points, a do and a don't, and quiz questions in the kit
3. Passwords and multi-factor authentication (8 min)
   • Use a password manager and a different long passphrase for every account.
   • Turn on multi-factor authentication (MFA) everywhere it's offered; prefer an authenticator app or security key over SMS.
   • 2 more points, a do and a don't, and quiz questions in the kit
4. Using AI tools safely (8 min)
   • Use only AI tools the company has approved for work.
   • Don't paste confidential, customer or personal data into AI tools unless the tool is approved for that data.
   • 3 more points, a do and a don't, and quiz questions in the kit
5. Handling information (7 min)
   • Know the labels: Public, Internal, Confidential, Restricted.
   • Share confidential files through approved tools with named people, not public links or personal email.
   • 2 more points, a do and a don't, and quiz questions in the kit
6. Phone, text and in-person tricks (6 min)
   • Callers may pretend to be IT, a bank, a supplier or a senior leader.
   • A voice or video can be faked. Urgent money or access requests need a call-back on a known number.
   • 2 more points, a do and a don't, and quiz questions in the kit
7. Devices and working remotely (6 min)
   • Install updates when prompted; restart to finish them.
   • Use only company-approved software and browser extensions.
   • 3 more points, a do and a don't, and quiz questions in the kit
8. Reporting incidents (5 min)
   • Report suspicious emails, lost devices, strange account activity, data sent to the wrong person, and anything an AI tool did that it shouldn't.
   • Report even if you're not sure, and even if you made the mistake. Speed limits damage.
   • 2 more points, a do and a don't, and quiz questions in the kit

Take the free 10-question quiz