Firewalls, endpoint detection and a full security stack still fail if someone clicks a phishing link, gives away a password or plugs in an unknown USB drive.
Human error sits at the start of the large majority of cyber attacks. Security awareness training changes that behaviour. A slide deck for the compliance folder does not.
Why traditional training fails
A yearly presentation on cybersecurity doesn't change what people do. Staff sit through it, lose most of the content within a week and return to the same habits.
Training that works is:
- Regular, run through the year rather than as an annual event
- Practical, built around actions people take at their desks
- Measured, with simulated phishing that records real behaviour
- Specific, covering situations your team actually meets
- Brief, in five to ten minute modules instead of hour-long sessions
What good training covers
Phishing recognition
Spelling mistakes used to be the giveaway. They aren't now. Current phishing mail is fluent. People need to learn:
- Urgency used as pressure, such as a warning that an account will lock in 24 hours
- Impersonation of a director, IT or finance
- Link inspection: hover, then check the real domain
- Unexpected attachments, which should stay closed
- How to report a suspicious email internally
Password and authentication hygiene
- Unique passwords on every service, because stolen credentials are tried across many systems in credential stuffing attacks
- How to use a password manager
- Why multi-factor authentication should stay on, even when it slows a login
- MFA fatigue attacks, which send repeated approval prompts to wear someone into accepting one
Social engineering
- Pretexting, where an attacker poses as a supplier, IT support or a new starter
- Vishing, which is phishing by phone
- Physical gaps: following someone through a door, unlocked screens and passwords left in view
Data handling
- What counts as sensitive data
- How to share files through approved systems, not a personal mailbox
- A clean desk policy
- How to report a data incident
Simulated phishing campaigns
Simulated phishing is the part of a programme that most reliably changes behaviour. Your provider sends realistic messages that cannot harm anyone, then records who clicks, who reports and who ignores them.
Anyone who clicks is told, straight away and without a telling-off, which signals they missed. Keep running the simulations and the click rate falls. Most businesses go from 30 to 40% of people clicking to under 5% inside 12 months of regular simulations.
Training, then a simple way to report
Spotting a bad email only helps if reporting it is easy. An AI helpdesk can take that first report, log it and pass anything that needs a person onwards.
What it costs
Platforms such as KnowBe4, Proofpoint Security Awareness and Microsoft Attack Simulation Training usually sit in this range:
- Per user: £2 to £5 per user per month
- For a 50-person business: £100 to £250 per month
Microsoft 365 Business Premium includes Attack Simulation Training at no extra cost. For many firms, it's already in the licence.
How Wanzo runs security awareness
Clients on our managed IT retainer get Microsoft's own training and simulation tools inside the cybersecurity work. We set the simulations up, timetable the modules, read the results and change the programme from what the figures show. Reports go to you on a regular cycle. There's no extra platform to buy or run.
What to do next
If you want this included in the monthly service that looks after your IT, send us a note. Include headcount and the Microsoft licences you hold, and we'll outline how the programme would run.