Many attacks do not begin with a technical vulnerability but with a message, a call, or a link that a person is supposed to react to. Security awareness refers both to the knowledge and attitude with which employees recognize such situations and to the measures companies use to build this awareness.
The goal is not to label people as a weakness but to make them an effective part of the defense. Anyone who reports an attack attempt early can prevent an incident or limit its damage. The NIS2 Directive also explicitly counts cybersecurity training among the risk management measures.
How does security awareness work?
Effective programs rely on repetition rather than a one-time mandatory training session. Typical building blocks are:
- Short, regular learning units on phishing, passwords, multi-factor authentication, handling confidential data, and working on the road or from home.
- Phishing simulations that send realistic but harmless test messages and show where further explanation is needed.
- Role-specific content, for example on payment fraud for accounting, on applications with attachments for HR, or on privileged accounts for IT administration.
- Clear reporting channels, for example a report button in the email program or a fixed point of contact.
- Alerts on current threats when new scams are circulating.
A culture that tolerates mistakes, in which reports are welcome even if someone has already clicked, is essential. Anyone who fears sanctions reports late or not at all.
Typical examples
- A supposed invoice leads to a sign-in page with a different address. The employee reports the message, and IT removes similar emails from other mailboxes.
- Accounting receives an urgent payment instruction in the name of management and checks back via a known phone number, see Business Email Compromise.
- A supposed IT support agent asks for a verification code on the phone. The employee does not disclose it and recognizes a typical case of social engineering.
- A USB stick someone found is not plugged in but handed in to IT.
What companies should keep in mind
- Plan awareness as an ongoing process, with short, regular formats instead of an annual mandatory event.
- Involve managers. They are frequent targets of attacks and role models at the same time.
- Design phishing simulations transparently, do not use results to expose individuals, and involve the works council and data protection early.
- Measure impact not only by click rates but also by how many suspected cases are reported and how quickly.
- Do not replace technical safeguards: awareness complements email filters, multi-factor authentication, and updates.
How TOMORIS relates
TOMORIS UNIVERSITY offers awareness training and learning paths.
Discover awareness training