People are targeted because attackers know they’re often easier to trick than technology. Training is one way to reduce that risk, but not all training works.

Why it matters

Phishing, fake invoices, and impersonation scams succeed because they look legitimate. Even excellent technical defenses can’t stop an employee from willingly giving away a password.

What doesn’t work

– One annual, hour-long video that everyone clicks through

– Long, technical lectures

– Blaming and shaming people who make mistakes

– Training with no follow-up or measurement

What works better

– Short, frequent sessions: a few minutes at a time, throughout the year

– Relevant examples: real scams that target your industry

– Practice: simulated phishing emails with immediate feedback

– Clear actions: how to report suspicious messages, and whom to call

– Positive culture: reward reporting, even when it’s a false alarm

– Role-specific training: finance staff need to know about payment fraud, executives about impersonation, and IT about privileged access

– Leadership participation: when managers take it seriously, so do employees

Topics to cover

– Spotting phishing and fake links

– Business email compromise and payment change requests

– Password managers and MFA

– Safe use of AI tools

– Handling personal information (Law 25)

– Physical security and remote work

– Reporting incidents quickly

Measuring success

– Phishing simulation click and report rates

– Time to report suspicious messages

– Number of real incidents

– Training completion rates

Realistic expectations

Training won’t eliminate risk, but together with MFA, email filtering, and good processes, it reduces it meaningfully.

Make it part of onboarding

Train new hires in their first week.

DBR Soft offers ongoing security awareness training programs. Contact us for more information.