By Joe Engelking, CEO. Published November 2026.
Security awareness training teaches your staff to spot and report phishing, fake invoices, and other tricks before they cost you money or data. It works when it is short, frequent, and paired with an easy way to report something suspicious. It fails when it is a yearly video that people click through. This guide covers what to include, how often to train, how to run phishing tests without punishing anyone, and what to do in the first hour after someone clicks.
Why do employees ignore security awareness training and still click phishing links?
Most people are not careless. They are busy, and a good phishing email looks like routine work: an invoice, a shared file, a password prompt. A yearly video does not change what someone does at 4:45 on a Friday. Three problems show up again and again:
- The training is too long and too rare, so nothing sticks.
- People worry about getting in trouble, so they hide a mistake instead of reporting it.
- Reporting is hard. If forwarding a suspicious email takes five steps, nobody does it.
What should security awareness training cover?
Cover the attacks your staff will actually see. For most small businesses that is the short list below.
| Topic | What staff learn | Why it matters |
|---|---|---|
| Phishing emails and texts | Check the sender, look at the link before clicking, and question urgency | Most attacks start with a message that looks like routine work |
| Fake invoices and payment changes | Confirm any change to bank details by phone, using a number you already have | Payment fraud depends on nobody double-checking |
| Passwords and MFA | Use a password manager and never approve a sign-in prompt you did not start | Stolen passwords are far less useful when MFA is on and prompts are not approved by mistake |
| Shared files and links | Treat an unexpected file as suspicious and confirm with the sender another way | Fake “shared document” pages are built to steal passwords |
| Reporting | One button or one address for anything suspicious, with no blame | Fast reporting is what limits the damage |
| Remote work and phones | Public Wi-Fi, lost devices, and personal accounts on work devices | Attackers go where the controls are weakest |
How often should we train, and do phishing tests help?
Short and regular beats long and rare. Five to ten minutes on one topic, several times a year, plus training in a new hire’s first week, works better than one annual session.
Simulated phishing tests help as practice if you treat them that way. Measure how many people report the test, not how many click, and never name or shame anyone. Tests that punish teach people to hide mistakes, which is the opposite of what you want.
What should happen in the first hour after someone clicks?
Decide this before it happens and put it where people can find it. The usual order:
- The employee tells IT right away. No blame.
- Change the password from a different, clean device and sign out all active sessions.
- Check the mailbox for new forwarding rules and unfamiliar sent messages.
- Confirm the MFA settings have not been changed.
- If the person opened a file, isolate that computer from the network.
- Warn coworkers and customers if the account sent any messages.
Speed is the difference. At Hansen & Cleary, a law firm we support, our security monitoring flagged a clicked suspicious link and odd activity on an assistant’s email. We got an instant alert and called. She told us a lawyer had sent a file that kept rejecting her password, and she had forwarded it to another lawyer, who ran into the same thing. We reset her password, informed the firm, and stopped the attacker before there was damage. See how we handle this for law firms and in our cybersecurity service.
Can we run security awareness training ourselves?
Yes. Free and low-cost tools exist, and many businesses start there. The hard part is consistency: someone has to schedule the sessions, follow up with the people who skip them, and run the tests. User training is built into every LME managed IT plan, so it does not depend on one busy person remembering. For the broader argument, read why employee training matters more than a better firewall.
Frequently asked questions
What is security awareness training?
Security awareness training teaches employees to recognize phishing, fake invoices, risky links, and other common attacks, and to report them quickly. It covers habits and decisions, not just a one-time lesson.
How long should a training session be?
Five to ten minutes on one topic is enough. Short sessions several times a year, plus a session in the first week for new hires, work better than one long annual session.
Should owners and managers take the training too?
Yes. Owners and managers often have the most access, so a mistake on their account costs the most. Everyone with an email account should be included.
What should we do when someone reports a false alarm?
Thank them. A report that turns out to be harmless is still the behavior you want. If people feel foolish for reporting, they stop reporting, and that is when a real attack gets through.
Want your team trained without adding to anyone’s workload? Schedule a free consultation or call 847-496-5196.