Contents
Short answer
Start with a short basic session on the topics that really come up day to day, then repeat it regularly in small units. Just as important is a clear reporting route: staff should know where to report a suspicious event or their own mistake straight away – without fear of blame.
What staff really need to know
Emails, links and attachments
Recognise phishing, don’t open suspicious attachments and links, ask when in doubt.
Sign-in and passwords
Use multi-factor sign-in, never share codes, password manager instead of notes.
Payments and CEO fraud
Always confirm payment changes and urgent instructions “from the top” via a known route.
Confidential data and devices
Store customer data only in approved systems, report lost devices immediately.
Reporting incidents
Who do I call when something looks odd? Everyone must know the answer.
AI tools
A short note on which data must not be entered into AI services and where the company rule is.
A simple programme
- 1
Start
A short basic session for everyone, practical with examples from your business.
- 2
Afterwards
Regular short refreshers rather than rare long sessions. You decide how often – there is no general legal frequency for all businesses.
- 3
Day to day
Clear reporting routes and a contact person who responds quickly.
- 4
When things change
Briefly explain new tools, processes or current scams.
Step by step
- 01
Assign responsibility
Name one person to look after the topic – it needn’t be an IT specialist.
- 02
Tailor content to your day-to-day
Use examples that actually happen in the business: invoices, parcel notifications, customer enquiries.
- 03
Set up a reporting route
A phone contact or a fixed address for suspected cases. Acknowledge every report briefly.
- 04
Run the basic session
Short, concrete, with time for questions. New staff get it when they start.
- 05
Repeat
Small units, for example as a short item in team meetings.
- 06
Back it with processes
Training works better when processes support it – for example a fixed call-back rule for payment changes.
Report, don’t hide
Why it matters
A click reported early can often be contained. A hidden mistake gets more expensive. Awareness built only on fear of mistakes tends to encourage hiding.
What helps
Make reporting explicitly welcome, thank people for reports rather than reprimand, learn from cases together. Blame is not a security concept.
Phishing simulations: benefits and limits
Possible benefits
Simulations can show whether content lands and give a chance to practise.
Limits
They’re not mandatory for every business. Done badly, they can damage trust. Results should be for learning, not for exposing individuals.
Framework
Data protection, employment law and, where applicable, works council co-determination can play a role. Clarify this in general terms beforehand and seek advice if needed.
Checklist
- A responsible person is named.
- Everyone knows the reporting route for suspected cases and mistakes.
- The basic session has taken place; new staff get it when they start.
- Short refreshers are scheduled.
- A call-back rule for payment changes is in place.
- Reports are acknowledged, not sanctioned.
Common mistakes
- One long mandatory session a year and nothing else.
- Publicising or punishing mistakes.
- Using generic examples instead of cases from your own day-to-day.
- Not naming a clear reporting route.
- Treating training as a substitute for technical protection.
Frequently asked questions
How often should we train?
There’s no single frequency for everyone. A basic session at the start followed by regular short refreshers and updates on new risks has proven useful.
Do we have to run phishing simulations?
No, not every business has to. They can complement training but have limits and a legal framework.
Do we need an external training provider?
Not necessarily. Much content can be delivered yourself using material from the BSI and the Alliance for Cyber Security.
What if someone clicked a phishing link?
Report it immediately, have the password changed and follow your incident plan. Thank the person for reporting.
Who should be trained?
Everyone with access to email or company systems – including management and temporary staff.
Sources
- BSI – Awareness: Problembewusstsein und sicheres Verhalten
- Allianz für Cyber-Sicherheit – Social Engineering
- ENISA – Cybersecurity guide for SMEs: 12 steps (2021)
Checked on 7 October 2026.
This content is for general guidance. No measure guarantees that an attack or outage is prevented.