TL;DR: Being good with technology and being good at spotting cyber threats are separate skills. Younger staff who grew up online still fall for phishing emails, fake login pages and dodgy sign-in requests. Every person in the business has different gaps, so cyber security training works best when the whole team does it together and does it regularly. Our Business Armour suite includes monthly interactive end user training for less than the price of a cup of coffee per user, per month.
The assumption that leaves a gap
Plenty of businesses assume their youngest staff are the least likely to get caught out online. They've had smartphones since school, they use social media every day, and they pick up new apps without a manual. It seems reasonable to think they can look after themselves.
That assumption is risky. Cyber criminals don't check how confident someone is with a laptop before sending them a phishing email. They're waiting for one person to click at the wrong moment.
Comfort with tech and cyber awareness are separate skills
Someone can jump between half a dozen apps without thinking, set up a new phone in minutes and fix the office printer before IT gets a call. None of that teaches them to spot a convincing fake Microsoft 365 login page, or to question an email that looks like it came from the finance director.
The same goes for passwords. Being quick with technology often means signing up for things quickly, and that tends to mean reusing the same password across work and personal accounts. When one of those personal accounts is breached, the business account is exposed too.
Some businesses aim their training at the people they consider "less technical" and expect newer, younger team members to pick things up as they go. That leaves a whole group of staff who never get taught what an attack actually looks like.
Not sure where to start?
Let's talk it through.
Have a quick, no-obligation call with our team.
No pitch, just answers.
Everyone has different blind spots
Knowledge gaps don't follow age or job title. One person might spot a suspicious email straight away but use the same password everywhere. Another might have excellent password habits but approve an unexpected multi-factor authentication prompt because it looks like the ones they see every day.
Attackers are looking for the easiest way in, and that's usually whoever trusts something they shouldn't. You can't predict who that will be, which is why training has to include everyone, from the newest starter to the managing director.
Training has to match how people work now
A large share of work now happens on mobile phones. Staff approve sign-in requests while travelling, open attachments on personal devices, reply to emails between meetings and flick between work and personal apps all day.
Each of those moments is a chance to make a mistake that wasn't possible a few years ago. A phishing message is much harder to spot on a small screen when you're walking to your next appointment. Good training uses those real situations, so people recognise them when they happen.
Make checking the normal thing to do
The most useful thing training can do is make questions feel normal. If someone gets an email they weren't expecting, or a login request they didn't trigger, they should feel comfortable stopping to check with a colleague or with IT.
A five-minute check costs nothing. Hoping someone made the right call can end with a compromised mailbox, a fraudulent payment or days of disruption.
Monthly interactive training through Business Armour
A single training session once a year fades quickly. People forget what they learned, new threats appear, and new starters miss it completely.
That's why monthly interactive end user training is part of our Business Armour cyber security suite. Short, regular sessions keep the whole team practising good habits all year, rather than cramming once and forgetting by spring.
It costs less than the price of a cup of coffee per user, per month. For most businesses that's a small line on the budget compared with the cost of recovering from one successful phishing attack.
Business Armour is run by our dedicated cyber security team, a separate group from the engineers who handle day-to-day IT support. Training fits into a wider set of cyber security services built around how your business works.
Get your whole team up to speed
If your team hasn't had cyber security awareness training for a while, or you're relying on people to work it out for themselves, we can help. We support businesses across Chester, North Wales, the Wirral and the wider North West, and we're happy to talk through what would suit your team.