Security Awareness Training For Employees

Security awareness training for employees usually covers email and stops there. The attacks that work best target something else entirely, which is ordinary politeness.

Tailgating. Someone carrying boxes follows a staff member through a secure door. Challenging them feels rude, so almost nobody does.

Pretexting on the phone. A caller who sounds like a new starter in another office, apologetic and slightly rushed, asking for a small favour.

Authority pressure. A request that appears to come from a senior person, with urgency attached and a reason not to check.

Each works because refusing feels like being unhelpful or suspicious. The most useful thing training can give people is permission to verify, and a manager who visibly backs them when they do.

The Australian Cyber Security Centre publishes guidance on social engineering. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s cyber security course and code of conduct training.