Cyber security awareness training for employees: why it matters
Cybersecurity is not just the IT team’s job. Every employee plays an important role in ensuring their organisation is as secure as it can be to defend against threat actors. We speak about it all the time, but nothing has changed – human error still remains one of the leading causes of data breaches across the globe. Whether that involves clicking a phishing link, using weak passwords or the same passwords across multiple accounts, threat actors know this, and use increasingly sophisticated tactics to exploit that human behaviour.
Your organisation needs to ensure its employees have the necessary cyber awareness training, equipping them with the knowledge to identify and respond to cyber threats effectively. Use this blog as a handy guide to share with your colleagues as we get into some of the best (and dare we say it “easiest”) ways to protect your business!
Cybersecurity awareness training: Why it matters
To reduce cyber risk, organisations should consider implementing cybersecurity awareness training. Training ensures employees are equipped with the knowledge to identify and respond to threats. By carrying out regular training, you will also help your organisation to enhance ISO 27001 compliance, as well as regulations like the GDPR.
Your employee training should be:
- Regular and up-to-date: Cyber threats evolve constantly. Annual training isn’t enough. Regular updates and reminders help keep knowledge fresh.
- Engaging and interactive: Training that involves simulations (like phishing tests), videos, and quizzes tends to be more effective than static slide decks.
- Tailored to roles: A finance team member may need different guidance compared to a software developer or HR administrator.
Key topics to include in awareness training
- Recognising phishing and social engineering
Teaching employees how to spot suspicious emails, messages, or phone calls is essential. Even the most convincing messages often have small giveaways, and training should show what to look for. We offer phishing awareness training and employee phishing assessments. - Password hygiene
Encourage staff to use strong, unique passphrases for different services. Where possible, promote the use of password managers and multi-factor authentication (MFA). - Device security
Employees should understand how to secure their work devices, whether that’s enabling encryption, not leaving devices unattended in public places, or avoiding unsecured Wi-Fi networks. - Data handling and classification
Staff should know how to recognise sensitive data, how to store and share it appropriately, and when to report accidental disclosure. - Incident reporting
Foster a culture where it’s safe and encouraged to report mistakes, suspicious activity, or potential breaches. Early detection can prevent larger incidents.
Creating a security-conscious culture
Training alone isn’t enough, though. organisations should aim to embed a cyber-aware culture. This means:
- Tone from the top: Senior leaders should champion secure behaviours and complete the same training as other employees.
- Clear policies: Make it easy for staff to understand and follow cyber policies.
- Positive reinforcement: Reward secure behaviour (e.g. recognising employees who report phishing).
- Open communication: Cybersecurity should be seen as a shared responsibility, not a punitive or secretive discipline.
James Richards discusses the importance of cybersecurity training for your organisation and how to make the training sessions engaging for your employees.
Good password practices
Passwords are part of our everyday life. Nearly every website visited, service or application accessed will insist on creating an account and prompt the user to think of a password. With remote working being the norm, the number of passwords users must remember has significantly increased, as most typical intranet and remote-working applications now require additional authentication before being accessed. A survey by NordPass estimated that an average person has 70-80 different accounts.
Does your organisation have password policies in place? If not, now is the time to start.
The National Cyber Security Centre’s (“NCSC”) guidance on passwords recommends that users avoid predictable or common passwords and not repeat them across multiple accounts. Users should create a unique password for each service they access, using at least 12 characters.
The NCSC recommends that users use a “passphrase” rather than a password. A good example of a strong passphrase would be Yellow Coffee Mountain, which becomes YellowCoffeeMountain as a 20-character password.
It’s easy to see why the NCSC encourages unique passwords. If a password is used on a single service and this account is compromised, the loss is restricted to that account only. This means threat actors will be unable to extend their attack using the compromised password on different accounts.
However, in practical terms, this means 70 to 80 randomly generated passphrases for us to remember before we can access things we use in our everyday lives, such as checking our emails, accessing social media, or banking information.
The human brain cannot cope with memorising so many passwords. To avoid being locked out of their accounts, people usually resort to insecure workarounds such as using common passwords, repeating the same ‘easy-to-remember password across multiple services, re-using a password with an updated suffix, or storing the password on a sticky note on a monitor.
Such methods leave these users – and their organisations – vulnerable to threat actors, who are always lurking for their next victim, to steal information, leverage it for ransom pay-outs, or simply sell it on the dark web.
Enter password managers: a solution designed to deter users from using insecure methods of creating and passwords by taking away this burden. Password managers offer an alternate, more secure way of coping with password overload. They help users create and store credentials they use to access services. Such credentials are stored in a vault, which is encrypted and accessed through a master key.
Types of password managers
Enforcing the use of a password manager can help organisations to reduce the risk of credentials compromise and brute-force attacks. Password managers come in three different types:
On-device managers
These store data securely on a single device. The data will only be compromised if the threat actor accesses the device beforehand. This type of password narrows the attack vector to the device itself, as the passwords can only be used on the device, they are stored in. However, if the device itself is compromised, there is no guarantee the passwords will be safe, for instance, if the hard disk becomes corrupt and the vault has not been backed-up; the stored passwords will be lost. Additionally, users who access the same service on multiple devices (e.g., laptops, phones or tablets), will not benefit from this option.
Cloud-sync managers
The data are transferred to a remote server and accessed across multiple devices. This allows the passwords to be synced across different platforms, and in enterprise environments, allows administrators to centrally monitor and manage the passwords for the organisation. However, threat actors will have a single point of compromise for all passwords stored, should an account be inadvertently accessed.
Browser-based password managers
These password managers are an extension to a user’s preferred internet browser and store the passwords within the browser itself. They offer the convenience of having passwords auto-filled when browsing the internet with that specific browser. Though no matter how secure passwords are, they risk being stolen when accessing malicious websites. Browser-based managers are susceptible to attacks conducted through JavaScript malware, such as drive-by-download attacks, where malware is unintentionally downloaded, and credentials are stolen on the victim’s computer.
Benefits of password managers
Passwords are important when it comes to online security and protecting corporate secrets. When properly used, they can offer a strong defence mechanism. Having a software tool that stores and remembers all passwords eases the burden of having to remember unique, complex passwords and subsequently makes it harder for threat actors to guess passwords, ultimately increasing the quality of passwords being used. By enforcing password managers, organisations will help staff reduce their reliance on insecure workarounds (such as a post-it note on a monitor), giving greater control and visibility over the usage of passwords across the organisation.
Risks of password managers
Like any other software, password managers have vulnerabilities. Threat actors will often target password managers, as compromising an application that single-handedly controls access to sensitive information proves to be an attractive target, especially in corporate environments.
Moreover, devices that are already compromised will hinder the password manager’s ability to secure the data. For instance, if a device contains malware, it could potentially record the master password and allow a threat actor access to the password manager.
Users can also forget their master password and if using a password manager that does not have a recovery feature, suffer the taunting task of resetting each individual login. What is more, password managers may be a completely new concept to some users, who may be reluctant to adhere to their use and revert to insecure ways of storing their passwords.
What password manager should your organisation choose?
There is a wide variety of password managers to choose from, each with its own set of unique features tailored to specific needs. Before committing to a specific product, organisations must consider the usability requirements of the product towards their needs, along with the level of protection of the stored credentials. There are even cases where organisations discard the use of password managers altogether and instead opt for an effective single sign-on process, where users authenticate once and access multiple services.
There is no silver-bullet solution when it comes to choosing a password manager, as each type of password manager comes with its own benefits and drawbacks. Regardless of the type of password manager, these features should be taken into consideration before committing to the product:
Strong Encryption
Credentials at rest should be encrypted to deter threat actors from reading your sensitive information. When choosing a product, companies must analyse which encryption algorithm they use to encrypt data at rest and ensure that such algorithm is recommended by the NCSC, NSA or any other equivalent government entity. Advanced Encryption Standard with 256-bit keys (AES 256) is the current industry standard algorithm of choice to secure data at rest because of its exceptional strength.
Data in transit must also be encrypted by the cloud-sync password manager to protect the password information as it is transferred over insecure and untrusted networks between the cloud application and the client. The transmitted data should be securely protected until added into the vault to hinder the threat actor’s efforts in intercepting and reading/modifying data.
Access to credentials & master password recovery
Organisations must ensure the password manager does not allow unauthorised access to passwords without the decryption key. In addition, ensure the password manager implements the zero-knowledge architecture. This means that before passwords leave a device and are stored, they are encrypted, so the provider does not have any means to decipher sensitive data. Although some providers offer means to recover an account (such as team members, a system administrator or a service provider), such methods can be exploited to access credentials. Thus, organisations should carefully consider whether the risks associated outweigh the cost of losing access to the data in the vault.
Multi-factor authentication & biometrics
Some password managers support multi-factor authentication (MFA), and amongst these additional methods, they offer biometric authentication. Companies ought to aim for a product that supports this feature and take full advantage of it. If a threat actor compromises an account, this additional layer of security will prevent them from accessing it without being in possession of the additional authentication mechanism.
Multi-factor authentication (MFA) is one of the simplest and most effective ways to strengthen account security. By requiring a second step such as a mobile app confirmation, biometric scan, or hardware token, MFA significantly reduces the risk of unauthorised access, even if a password is compromised. With phishing attacks and credential breaches on the rise, relying on passwords alone is no longer sufficient to protect sensitive systems and data.
For organisations, implementing MFA across key systems, especially email, cloud services, and VPNs, should be a baseline security control. It adds an essential layer of protection that can prevent data breaches, safeguard intellectual property, and maintain customer trust.
According to Microsoft, MFA can block over 99.9% of account compromise attacks1.
When paired with strong password policies and regular employee training, MFA plays a crucial role in reducing your organisation’s exposure to cyber threats.
Policies
Enterprise password managers should allow for high-privilege accounts to exist, giving these administrators the ability to recover accounts and control shared passwords. Administrators should also be able to enforce sets of policies that dictate how password managers are used within the organisation. They should also have visibility of accounts in a user’s vaults (including shared passwords) to aid them in the moving/leaving process. Auditing and logging, as well as mandating MFA, should be options available to administrators, along with an audited password score, to allow them to improve the password quality within the organisation.
Logging and monitoring
Password managers should capture log data to enable administrators to oversee activities related to passwords. Some activities include who and when a password was accessed, or who can access a shared password. Control over device enrolment should also be considered an important feature, along with the ability to reset master passwords and monitor failed login attempts.
Sharing
Although highly discouraged, in specific scenarios, users must share passwords between them. When evaluating this functionality, organisations should ensure users are able to see the difference between shared and individual passwords in the application. In addition, administrators should be able to control who can access shared passwords, and such access should be logged. In the case the shared password is changed, it should be synced between users who can access it.
Conclusion
For organisations looking to strengthen their cybersecurity posture in 2025, password managers are a vital tool, but they’re only one piece of the puzzle. With employees accessing a growing number of services and applications, it’s essential to ensure credentials are protected using strong, unique passphrases stored securely within a trusted password manager. Solutions should include strong encryption, support for multi-factor authentication (MFA), and features tailored to enterprise needs such as policy enforcement and auditing.
However, technology alone is not enough. Cybersecurity awareness training must be embedded across the organisation to empower employees to recognise and respond to common threats, especially phishing attacks. Training should be ongoing, role-specific, and include practical guidance on secure password habits and the importance of MFA.
Together, these measures, strong credentials, secure storage, layered authentication, and an informed workforce help build a culture of security. By investing in the right tools and training, organisations can significantly reduce the likelihood of data breaches and enhance their overall cyber resilience.
If you would like some expert help from our cybersecurity consultants, we can help. Not only do we offer phishing awareness training and assessments, but we also offer cyber incident response, supply chain security and employee awareness training. Our security consultants have experience working with small to large teams alike, across multiple industries and are expertly placed to ensure you get the most out of your engagement, strengthening your security posture and helping to mitigate cyber attacks and potential breaches.
Talk to our friendly team today!
