People & training
The human firewall: why cybersecurity training still matters
Staff need systems they can use safely and practice in checking unusual requests. Training connects the tools to the decisions people make at work.
Your organization has invested in email filtering, device protection, multi-factor authentication and backups. Those are important protections. Then an employee receives a convincing message asking them to share a document or change a supplier's payment details.
The next decision involves a person. Do they recognize that the request needs checking? Do they know how to verify it? Will they feel supported if they delay the work to ask?
Training prepares staff for that decision. The “human firewall” describes people who can recognize a concern and take a sensible next step, with tools and procedures that support them.
Give people a secure system to work in
Training works best when the organization has made safer choices practical. Staff need approved ways to share documents, protect their accounts and report suspicious activity. Management needs to make sure those systems are configured, maintained and supported.
If sharing a client file securely is confusing, people may fall back on personal email. If a reporting process is difficult to find, a concern may sit unnoticed. Those are problems to fix in the working environment as well as topics to explain in training.
Keep technical protections in place. A careful employee can still be deceived, and a well-configured system can help limit what happens after a mistake.
Practise the decisions people actually face
Use the situations people encounter in their jobs. Accounts staff may need to verify changed banking details. A receptionist may receive an urgent call asking for information. A project manager may need to share files with an outside adviser.
The Canadian Centre for Cyber Security recommends training tailored to business needs and job responsibilities, including practical exercises and incident reporting. Managers, executives and contractors need appropriate training too.
Walk through an example together. Ask what information is available, what would make the request unusual and how the person would check it using a trusted contact or approved process. Give them a chance to try the reporting route they would use afterwards.
Teach people to verify, not just spot mistakes
Fraudulent messages can be polished and arrive through a familiar account. Spelling checks and a quick look at the sender are useful observations, but they are not a complete decision process.
Teach the actions that matter: pause before an unusual request, verify a payment change through a known contact, decline an authentication request you did not initiate and ask before sharing sensitive information.
Include everyday AI use in that conversation. Staff should know which tools are approved, what information must stay out and who reviews the result.
Make prompt reporting a normal part of work
People need a clear contact and an easy way to raise a concern, including after they have clicked a link or sent information. Tell them what to report and what happens next.
Thank someone who reports promptly. An immediate conversation gives the response team a better starting point than a mistake hidden out of embarrassment. Managers should reinforce that asking for help is part of doing the job responsibly.
Keep learning connected to real work
Start with onboarding, then use short refreshers and discussion when systems, procedures or risks change. If you use simulated phishing, agree on its purpose and handle the results constructively rather than publicly ranking or embarrassing individuals.
Course completion is worth tracking, but also ask whether people can find the reporting process and carry out the expected checks. Use questions and feedback to improve both the training and the underlying procedures.
Help your team learn, notice and act
Zen Cyber provides instructor-led cybersecurity training that helps people recognize risks and make better decisions at work and at home. We can help you choose practical topics and connect the learning to the systems and procedures your team uses.