Security awareness training that actually changes behaviour
Annual slideshows rarely stop a convincing scam. Here is what effective awareness training looks like, and the habits worth building first.
Attackers take the easiest route in, and that is usually a person. A well-written email, a convincing phone call or a message that seems to come from the boss can achieve what months of technical hacking could not. That is why security awareness training matters, and why so much of it fails.
How people are targeted
The tricks change, but the patterns are familiar to most organisations across Africa:
- Payment fraud: an email that appears to come from a supplier announcing “new bank details”, or a request from a “director” to make an urgent, confidential transfer. This is often called business email compromise.
- Fake support calls: someone claiming to be from your bank, mobile network or IT provider who asks for a one-time passcode, a PIN or remote access to “fix” a problem.
- SIM swap and account takeover: criminals take over a phone number to receive passcodes, then use it to reset passwords for email, banking or messaging apps.
- Fake sign-in pages: a link to a page that looks exactly like your email or file-sharing login, built to capture passwords.
None of these needs advanced technology. They rely on urgency, authority and trust.
Why traditional training fails
Many organisations run a single session a year: a long slideshow, heavy on jargon and fear. Some follow it with phishing tests designed to catch people out, then name or punish those who click.
The result is predictable. People forget most of it within weeks, the examples do not match what they actually see, and anyone who makes a mistake learns to keep quiet about it. The last point is the most damaging: an attack reported in five minutes is a minor incident; one hidden for a week can be a disaster.
What works instead
- Short and frequent beats long and rare. Brief sessions and reminders through the year keep the topic fresh.
- Relevant examples. Use the scams your staff actually encounter, in the channels they use: email, SMS, phone calls and WhatsApp.
- Practice, with instant feedback. Realistic phishing simulations, followed by a short explanation the moment someone clicks, teach far better than a lecture.
- Depth where the risk is. Finance, procurement, leadership, HR and IT staff need extra, role-specific guidance.
- Make reporting easy and welcome. A single, obvious way to report something suspicious, and a thank-you every time, including when someone admits they clicked.
- Leaders take part. When senior staff attend and follow the rules, everyone else takes them seriously.
Five habits to build first
If staff remember nothing else, these habits stop a large share of attacks:
- Check before you act. Confirm any change to bank details or any urgent payment request by calling a known number, not one in the message.
- Never share one-time passcodes, PINs or passwords. No genuine bank, network or IT team needs them.
- Report quickly, even after a mistake. Speed matters more than blame.
- Use multi-factor sign-in and a password manager. Unique passwords and a second factor make stolen passwords far less useful.
- Pause when a message is urgent or secret. Pressure to act now, or to tell no one, is a warning sign in itself.
Running phishing simulations ethically
Simulations are one of the most effective tools available, provided they are run fairly:
- get written authorisation from the organisation and agree the scope in advance;
- never collect real passwords or personal data;
- avoid themes that cause genuine distress, such as fake salary cuts or job losses;
- report results by team and trend, not as a list of names to discipline;
- always show a short, friendly explanation to anyone who clicks.
The goal is a workforce that recognises and reports attacks, not a high score.
Measuring progress
The most useful measures are about behaviour:
- Reporting rate: how many people report a simulated or real phishing message.
- Time to report: how quickly the first report arrives.
- Click rate over time: which should fall as training continues.
- Completion: whether everyone, including new starters, has taken part.
Records of training and results also help when auditors, regulators or clients ask how you manage people-related risk, including the security duties that come with handling personal data under the Nigeria Data Protection Act.
Where to start
Begin with a short baseline: one simulation and a brief survey. Then run a practical session for all staff, add focused modules for high-risk roles, and keep practising through the year. Within a few months, reporting becomes normal, and that is when an organisation becomes much harder to fool.