Call Now : 604-295-5355 | 3945 West 51st Ave, Vancouver, BC, V6N 3V9

Top 10 Security Awareness Training Topics for Your Employees

Security Awareness Training Topics for Your Employees

There is no single perfect solution to every problem, so it’s an unfortunate fact that even when you take extensive measures to protect your business, you may still find weak points that make you vulnerable. One such point that is sometimes overlooked is the role of employees in protecting the company. Kaspersky reports that human error accounts for 46% of cybersecurity incidents. Installing and maintaining the most advanced defenses will still not protect you if your employees unwittingly open the doors to potential threats.

To protect yourself from unintentional harm from within, you will need to provide an appropriate security training program for your employees. Here are some of the elements that should be included:

Bring-Your-Own-Device Policy

This policy would cover any personal computing device that your employee could use in the work environment. This includes tablets and phones but can also include other portable devices that could be used to record and steal confidential information, such as digital cameras and audio players. According to McAfee, these devices are not completely secure, with unlocked devices being more vulnerable than locked ones.

A list of banned devices should be made, but even devices that are deemed acceptable might have apps that pose a danger, so a list of such should be included. Training for employees should also be made available in order to ensure that they are aware of what is permissible in the work environment.

Additionally, employees should be made aware that their devices are being monitored and that they are required to follow the company’s password policy and keep their devices up to date with the latest antivirus program.

Removable Media

Imagine stumbling across a thumb drive or external hard drive. It might be found in the parking lot or some other location, with no sign of where it came from. Your employee might take it upon themselves to attempt to find the owner by bringing it into your business and plugging it in to their computer. What they don’t realize is that it was planted there, and they have now introduced malware to your system.

Unsolicited removable media needs to be prohibited and employees made aware of the danger that they can present.

Cultivate Safe Internet Habits

Given that virtually every employee has at least some access to the internet, it is crucial that they be cognizant of the proper use thereof. With the growing number of phishing attacks, for example, employees must guard against opening attachments from unknown or unverified sources. Unsolicited emails in general should not be trusted. Even emails that seem to come from friends or other contacts should be verified, especially if they come with an unexpected attachment.

Employees should also be prohibited from installing new software programs that have not been authorized.


Each employee should receive a training session on malware, learning the different types and how they operate. This training should cover topics like adware and spyware, Trojans, viruses, armoured viruses, ransomware, botnets, and logic bombs.

Train employees to recognize malware and how to respond to it. Their first reaction should be to turn off the device or system and report the incident to security management.


Hoaxes may not be immediately dangerous like other threats, but that doesn’t mean that they do not cause harm. Hoaxes are deceptions and falsehoods designed to victimize the users, and they often take the form of “warnings” of imminent danger, such as informing you of actions to take to avoid supposed harm about to befall your system.

Employees should be able to recognize hoaxes and know how to respond. Any threatening emails, for example, should be reported immediately to your IT security department.

Your employees can either serve as a powerful bulwark against cyber threats or the weak point that gives scammers and hackers access to sensitive data. It comes down to training, so provide them with the learning and support they need to support your business in return.