Phishing Challenges

Employees are the weakest link in most cyber security attacks. Effective training can help address this weakness by training employees to spot phishing emails. Training teaches employees how to detect and report suspected phishing attempts, helping them protect themselves and their organisations from cyber criminals and hackers who attempt to steal and use information for criminal purposes.

It depends. Many organisations conduct cyber security awareness training on an annual basis but the training is general and mostly intended to tick a box to comply with standards and regulations or to fulfil cybersecurity insurance standards. Also, once a year training is usually not enough to significantly reduce risk: it is not done often enough and is not specific enough to employees' job roles for them to retain the information and apply it in their everyday work lives. Additionally, the training is often outdated, boring and monotonous. Cyber and more specifically phishing training become much more effective when conducted two or three times a year in shorter bursts and when the training is updated, relevant to job roles, and hands-on.

Cyber security training is most effective when delivered in short, micro-learning modules and users retain the information best when it is relevant to their individual circumstances and level of expertise. Just as IT professionals may not need to be experts in password protection, HR staff don’t need to know the technical specifications of the business’ firewall.

Phishing training can be delivered in short modules that consist of scenarios which help employees understand which course of action to take in different situations. This type of mini course can be completed in as little as ten to fifteen minutes, and can be spread out over the course of the year.