Cybersecurity awareness for every employee
Half a day on phishing, payment fraud and device discipline, sorted on real sample emails rather than slides.
- Duration
- Half day, 4 contact hours
- Level
- Awareness
- Standard
- Standard-agnostic. One channel of your own awareness programme
- Prerequisites
- None. No technical background assumed
- Assessment
- Phishing identification on sample messages plus a 15-question check
- Certificate
- ITF certificate of completion
A half-day cybersecurity awareness course for general staff: phishing and business email compromise, passwords and multi-factor authentication, safe data handling, device and removable media discipline, remote working, and reporting an incident fast.
- 01 Enquiry
- 02 Needs analysis
- 03 Programme design
- 04 Scheduling
- 05 Delivery
- 06 Assessment
- 07 Certification
- 08 Records
Cybersecurity awareness for every employee sits at step 5 of the delivery cycle. You receive course materials and an attendance record.
The incident starts with a person, not a firewall
The most expensive thing that happens to a mid-size company here is often an invoice that got paid to the wrong bank account.
It does not require a sophisticated attack. It requires one credential taken from a browser that saved it, a few weeks of quietly reading a mailbox, and then a polite email from a familiar address saying the bank details have changed. Everything about that email is correct except the account number, and the person who pays it is doing their job properly.
Awareness training usually fails to prevent it because it teaches the wrong tell. It teaches spelling mistakes and urgent language, and the emails that actually work have neither. What works as a control is procedural: a payment or bank-detail change is verified through an independent channel, always, using a number you already had rather than the one in the email.
The other thing this course gets right is the reporting culture. A person who suspects they clicked something has to be able to say so in the next five minutes without a disciplinary attached. Speed matters more than certainty, and if the company has not said that out loud, nobody reports until it is obvious.
Four hours, and what is in them
Live online suits this course particularly well and allows a large cohort, which matters when the requirement is everybody.
| Session | What is covered | Time |
|---|---|---|
| The honest threat picture | Who attacks a mid-size company and why, credential theft and infostealers, ransomware entry routes, and the fact that most incidents start with a person. | 0:30 |
| Phishing, the core session | Anatomy of a phishing email, spoofed domains, attachment and link behaviour, business email compromise and invoice redirection fraud, plus a live sorting exercise on real sample emails. | 1:00 |
| Passwords and multi-factor authentication | Password managers, the limits of MFA, and what a compromised browser-saved password actually exposes. | 0:30 |
| Data handling | Classification, sharing, personal data, and what may and may not go into an external tool including an external AI service. | 0:30 |
| Devices and working outside the office | Updates, lock screens, USB media, public Wi-Fi, shoulder surfing and the lost device procedure. | 0:45 |
| Social engineering by phone and in person | Including the IT support impersonation call, which is the one that still works. | 0:30 |
| Reporting | Who to tell, how fast, and why reporting a mistake early is treated as a good outcome rather than a disciplinary one. | 0:15 |
What goes back to the desk
A one-page reporting card
The escalation route with the internal contact filled in, so nobody has to find out who to tell while it is happening.
A phishing red flags reference sheet
Built from the sample set used in the room, including the convincing ones rather than only the obvious ones.
A clean desk and device checklist
Short enough to be used. Lock screen, updates, removable media, what travels and what does not.
The attendance and assessment record
Per delegate. If your awareness programme has to be evidenced periodically, this is the evidence for one channel of it.
A ITF certificate of completion
Per delegate, naming the course, the date and the assessment result.
What every employee can do afterwards
- 01
Recognise the phishing types that actually work here
Spear phishing, business email compromise, invoice redirection, and the pretexts used against Saudi businesses.
- 02
Verify a payment or bank-detail change independently
Through a channel and a number you already had. The single control that prevents the most expensive incident.
- 03
Use a password manager and MFA properly
Including understanding what MFA does not protect against and why password reuse is the compounding risk.
- 04
Decide what may go into an external tool
Client data, personal data, commercially sensitive material. A decision rule rather than a blanket rule.
- 05
Handle a device outside the office
Public Wi-Fi, lock screens, USB media, and what to do in the first hour after a device is lost.
- 06
Report in minutes, not days
Knowing the route and knowing that early reporting is the wanted behaviour, which has to be said by the employer and not only by the trainer.
A changed bank detail, caught by luck
A distribution company in Dammam nearly paid a supplier invoice to a changed account last quarter, and stopped it only because a clerk happened to know the supplier's owner. The finance director wanted the accounts payable team, procurement and the two executive assistants trained first.
The sample set for the sorting exercise was built around the company's own supplier correspondence style, with names removed. The payment session produced a written verification rule: any bank detail change is confirmed by a call to a number already on file, by someone other than the person who received the request.
The reporting session put the name of the internal contact on the reporting card before anyone left.
The company ended up holding the verification rule in writing, reporting cards with its own contact on them, the attendance and assessment records for its awareness programme, and a certificate per delegate.
Who should be in the room
The tag on this course is all staff, but four groups carry materially more exposure than the rest.
The people who move money
Accounts payable, procurement and anyone who can change a bank detail. Invoice redirection fraud is aimed directly at this desk.
- Verify a bank-detail change through an independent channel, every time
- Recognise a compromised supplier mailbox rather than a spoofed one
- Know the internal rule and be backed when you enforce it
Custodians of personal data
HR staff and executive assistants, who hold personal data and whose calendars tell an attacker when the boss is unreachable.
- Classify and handle personal data correctly
- Spot the urgent request sent while the approver is travelling
- Handle a phone request for staff information
Working on personal devices
Anyone working from home, from a site, or on a personal phone, where the company's controls mostly do not reach.
- Use public networks without exposing credentials
- Keep company data off unmanaged storage
- Report a lost device before the end of the day
The whole workforce
The programme only works at full coverage. One untrained person with a mailbox is the whole exposure.
- Sort real sample emails correctly under time pressure
- Know what a compromised saved password exposes
- Report early without fear of blame
What compliance functions ask first
Does this satisfy the ECC awareness requirement?
NCA's Essential Cybersecurity Controls expect entities in scope to run a cybersecurity awareness programme, delivered periodically and through more than one channel. This course can be one channel of that programme, with attendance and assessment records as evidence. Whether it meets your obligation depends on your programme and your scope, and that is your compliance function's decision.
We need a year-round programme, not one session. Who designs that?
ITF Cyber. It sets out which groups learn what, through which channels, how often, and how completion is recorded. This course is the taught session at the centre of that programme.
How often should staff repeat it?
Annually as a floor, with shorter reinforcement in between. The ECC expectation is a periodic programme rather than a one-off session, and a single annual session with nothing between it is a programme on paper.
Can it run for the whole company at once?
Live online, yes, in larger groups than the 20 or so a room allows. The sorting exercise still runs for every delegate, so each person is assessed on the sample messages rather than watching someone else do it.
Is the certificate recognised?
It is an ITF certificate of completion, and it records that the participant attended and met the assessment criteria on the day. It is not an accredited qualification. It is the kind of evidence a management system asks for under ISO 9001 clause 7.2 and its equivalents. If your buyer or regulator names a certificate issued under an accreditation scheme, tell us at enquiry and we will say plainly whether ours fits.
Can you run it in Arabic?
Yes. Arabic, English, or Arabic delivery with English material, which is the usual request for a mixed room. Confirm the language when you book, because it decides which trainer and which handouts are scheduled.
Do you come to our site?
Yes, and it is the default. On your site the exercises run on your own documents and processes, and the participants lose no travel time. We need a room, a screen, and the participants released from the floor for the whole session.
How many people can attend?
Awareness courses work up to about 20. Courses with assessed practical work cap at about 12 to 15, so every person does the exercise rather than watching it. These caps are our teaching judgement, not an external rule.
Who delivers it?
Practising auditors. The people teaching these courses spend their working weeks inside factories, warehouses, kitchens and offices carrying out audits, and the examples in the room come from that work. The standard every trainer meets is set out on the trainers page.
What if someone misses a day, or does not pass?
There is no certificate for partial attendance or a failed assessment. The participant can join the missed day or retake the assessment on a later run, and we tell you which person and why. We would rather report a gap than issue a record that says something untrue.
Nearby
AI and digital tools in operations
The confidentiality boundary for external tools, covered properly rather than as a slide.
Read moreImplementationDocument and records control
Access rights, audit trail and backup, which is where security meets clause 7.5.
Read moreProgrammeIn-house and corporate programmes
Rolling awareness across every employee and evidencing the coverage.
Read moreITF CyberA year-round awareness programme
ITF Cyber designs the audience map, channels, calendar and evidence record this course sits inside.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Cover the whole workforce
Awareness training only works at full coverage, and the coverage record is the part an assessor asks for. Tell us the headcount, the sites and whether you need it online for scale.