The topics worth building a programme around are phishing and social engineering, password and MFA hygiene, device and remote working security, malware and backup basics, data protection and GDPR, cloud collaboration and OAuth risks, reporting and incident response, phishing simulation design, AI and deepfake threats, and insider risk. Phishing remains the most common attack type reported by businesses and charities, according to the Cyber Security Breaches Survey 2025, and the NCSC stresses that no training package teaches staff to catch every phishing attempt, which is why what you teach matters as much as whether you teach it at all.
TL;DR:
- Teach staff the reporting route before detection, then track reporting rates and containment time rather than judging success by simulated phishing clicks alone.
- Tailor data protection training by role, and train employees before they access personal data; consult ICO guidance when setting refresher intervals.
- Teach staff to verify unusual requests through a separate channel, especially when voice, video, or urgent messages seek money, credentials, or process exceptions.
- Involve HR before phishing simulations, keep exercises blameless, and reward reporting; punitive campaigns can damage trust instead of building resilience.
- Introduce password managers during onboarding, teach staff to reject unexpected MFA prompts, and explain that single sign on makes one compromised account more consequential.
Table of Contents
- The shortlist: security awareness training topics to cover this year
- Phishing and social engineering: what to teach and how to measure
- Credentials: passwords, MFA, single sign-on and account hygiene
- Device, remote working and mobile security
- Malware, ransomware and backup basics
- Data protection and role-based GDPR training
- Collaboration tools, OAuth and secure cloud sharing
- Reporting, incident response and the metrics that matter
- AI-driven threats, deepfakes and the evolving threat surface
- Designing delivery: cadence, engagement and avoiding common pitfalls
- How a managed IT partner assembles these topics into a programme
- Why practical topics and culture beat theoretical lists
- Getting an awareness programme that actually sticks
- FAQ
- Sources
The shortlist: security awareness training topics to cover this year
Think of this as the syllabus you could drop straight into a training plan or a board update. Each topic below earns its place because it maps to a real, common failure point, not because it looks good on a slide.
- Phishing and social engineering: teach influence tactics, business email compromise and how to report, not just how to spot a dodgy link.
- Passwords, MFA and account hygiene: password managers, passphrase habits and recognising MFA fatigue attacks.
- Device and remote working security: safe Wi-Fi use, patching discipline and handling removable media.
- Malware, ransomware and backups: infection warning signs and why timely reporting protects recovery.
- Data protection and GDPR: role-tailored content covering the data protection principles and breach reporting.
- Cloud collaboration and OAuth risks: safe file sharing and spotting over-broad app permission requests.
- Reporting and incident response: a visible, simple reporting route and the metrics that actually matter.
- Phishing simulations and culture: designed with HR input, measured without punishing people.
- AI-driven threats and deepfakes: verification habits for voice, video and text impersonation.
- Insider threats and acceptable use: data handling expectations and when to escalate concerns.
- Secure use of collaboration and productivity tools: covering Microsoft 365, Teams and shared drives.
- Role-specific deep dives: finance, HR and administrators each face different risks worth separate sessions.
A practical split works well: deliver core topics to every employee during onboarding, then layer role-specific tracks (finance, IT admins, HR) afterward. Keep refreshers short and frequent rather than relying on one long session; microlearning bursts can be more engaging than a lengthy lecture.
Phishing and social engineering: what to teach and how to measure
Phishing training works best when it goes beyond "don't click suspicious links". Staff need to recognise psychological triggers behind social engineering, including urgency, authority and curiosity. Business email compromise deserves its own mention, since it rarely involves a dodgy attachment and instead relies on a convincing request that looks like it came from a manager or supplier. QR-code phishing and OAuth consent prompts are newer variants worth covering too, since both slip past habits built around spotting fake links.
The single most useful behaviour to teach is reporting. A one-click "Report Phishing" button, a shared mailbox, or routing through the NCSC's Suspicious Email Reporting Service all work, but only if staff know exactly where to click and feel safe doing it.
- Teach the reporting path first, before teaching detection: a fast report matters more than a perfect catch.
- Measure the rate of reports, not just the rate of clicks, and treat a rise in reporting as a success, not a problem.
- Reinforce reporting in classroom sessions with a live walkthrough, not just a slide showing the button.
- Involve HR before running any simulated phishing campaign, as the NCSC warns that poorly handled simulations can damage trust rather than build resilience.
Pro Tip: Track your reporting rate month on month: a workforce that reports more suspicious emails over time is learning, even if its click rate barely moves.
Our own auditor-ready phishing simulation programme for small and mid-sized organisations was built around this principle: simulations exist to build habits, not to catch people out.
Credentials: passwords, MFA, single sign-on and account hygiene
Password advice has moved on from "change it every 90 days". The more useful message now is to use a password manager, choose long passphrases over complex but short passwords, and never reuse the same credential across personal and work accounts. Staff who understand why reuse is risky, one leaked account can unlock several others, tend to adopt a manager more readily than staff who are simply told to.
Multi-factor authentication needs its own explanation, not just a rollout. Staff should understand the difference between an authenticator app, a hardware key and SMS codes, and why app-based or hardware methods resist interception better than text messages. MFA fatigue attacks, where an attacker spams approval requests until someone taps "approve" out of frustration, are increasingly common and worth a short scenario exercise so staff recognise the pattern rather than clicking through it.
Single sign-on genuinely reduces password sprawl, but it also means one compromised account can open several systems at once, so staff need to know when something feels wrong enough to flag to IT.
- Introduce a password manager during onboarding and show, live, how to generate and store a passphrase.
- Run a short scenario where staff practise refusing an unexpected MFA prompt and reporting it.
- Explain single sign-on in plain terms: one login, several doors, so one compromised key matters more.
- Give finance and admin staff an extra session on recognising unusual access requests tied to their accounts.
IT teams rolling out conditional access alongside this training should read our guide on testing conditional access policies in report-only mode before enforcing anything live.
Device, remote working and mobile security
Remote and hybrid working put more decisions in employees' hands than office-based work ever did, which makes this one of the topics most worth a dedicated session. Public Wi-Fi is the obvious starting point: staff should know to avoid unencrypted networks for anything sensitive and to use a company VPN or mobile hotspot instead.
Patching discipline matters just as much, even though it rarely feels urgent to the person being nagged about an update. A device running outdated software is an open door, and staff should understand that postponing updates on a work laptop isn't a personal choice, it's a shared risk. The distinction between managed devices (configured and monitored by IT) and unmanaged personal devices used for work should be spelled out clearly, including what is and isn't allowed on each.
Removable media still causes problems: a found USB stick plugged in out of curiosity remains a classic infection route, and staff should know never to plug in unknown hardware.
- Explain why public Wi-Fi needs a VPN or mobile data, with a real example of an intercepted session.
- Set a clear patching deadline policy and explain the risk in plain terms, not just a reminder email.
- Teach safe removable media handling: no unknown USB sticks, ever, on a work device.
- Give staff a one-line escalation step: who to call the moment a device feels compromised.
Malware, ransomware and backup basics
Ransomware rarely arrives as a single dramatic event. It usually starts with a phishing email, a malicious attachment, or a compromised download, and the early signs, files renamed oddly, unusual slowdown, unexpected pop-ups, are often visible before full encryption hits. Staff who know these signs can buy valuable time simply by reporting early and disconnecting a device from the network rather than carrying on and hoping it resolves itself.
The 3-2-1 backup principle (three copies of data, on two different media, with one copy off-site) is worth explaining even to non-technical staff, because it changes how seriously people take their own role in protecting files. If staff understand that a corrupted file reported quickly can be restored from backup, but one left unreported for days might not be, reporting becomes an obvious choice rather than an afterthought.
- Teach the early warning signs of ransomware: renamed files, odd pop-ups, sudden slowdowns.
- Explain the 3-2-1 backup principle simply: three copies, two formats, one off-site.
- Set a clear rule on attachments and downloads: when in doubt, don't open it, forward it to IT instead.
- Stress that isolating a device (unplugging the network cable, turning off Wi-Fi) and reporting immediately helps containment.
Our guide to a tested 3-2-1 hybrid backup approach for small businesses is a useful companion read for anyone building this part of the programme.
Data protection and role-based GDPR training
Not every employee needs the same depth of data protection training. Someone processing customer records daily needs far more detail than someone who only handles internal documents, and treating both groups identically wastes time and dilutes the message for the people who need it most.
The ICO provides guidance on staff data protection training and refreshers. Use it to inform your training calendar and check the guidance for current expectations.
Content should cover core terms such as personal data, data subject and breach, alongside data protection principles in plain language: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. A short quiz at the end of each session, plus a clear escalation contact for anything that looks like a potential breach, rounds out the practical side.
- Tailor depth by role: full GDPR training for anyone handling personal data regularly, awareness-level content for everyone else.
- Train new starters before they access personal data, following ICO guidance.
- Schedule refreshers regularly, and consult ICO guidance when setting the interval.
- Give every employee a named contact for reporting a suspected data breach immediately.
New staff should receive data protection training before accessing personal data, according to ICO guidance. Consult the guidance when planning refresher training.
Collaboration tools, OAuth and secure cloud sharing
Modern phishing often targets permissions rather than passwords. When a staff member clicks "Allow" on a third-party app requesting access to their Microsoft 365 or Google Workspace account, they may be granting far broader access than they realise, sometimes to read email, access files, or act on their behalf. Staff rarely stop to read what they're approving, which is exactly why this deserves its own short training segment rather than a line buried in a general phishing session.
Safe sharing habits matter too. Access-controlled links that expire or require sign-in are safer than open "anyone with the link" shares, and attachments should generally be avoided in favour of shared, permissioned documents. A short scenario, showing a real-looking OAuth consent screen asking for excessive permissions, helps staff build a gut instinct for when something looks wrong.
- Explain that OAuth consent prompts can grant broad access, and teach staff to pause before clicking "Allow".
- Set a simple rule: unfamiliar third-party app requests go to IT for review before approval.
- Prefer access-controlled, expiring share links over open links or attachments.
- Run a short scenario showing a suspicious consent screen and ask staff to spot the red flags.
Our Microsoft 365 resources cover role-based collaboration habits like these.
Reporting, incident response and the metrics that matter
A reporting process only works if it's visible and genuinely easy to use. The clearest route for most organisations is the Microsoft Outlook "Report Phishing" add-in, configured to forward messages to a shared mailbox and, where relevant, the NCSC's Suspicious Email Reporting Service. Staff shouldn't have to remember an email address or dig through a wiki page; the button should be sitting in their inbox toolbar.
Metrics deserve care. Click rates on simulated phishing emails tell only part of the story and, used alone, tend to punish curiosity rather than reward vigilance. A far more useful set includes the positive reporting rate (how many suspicious emails get flagged, regardless of whether they were real), time to contain an incident once reported, and the number of escalations successfully resolved without wider impact.
- Configure a one-click reporting add-in that routes straight to a shared mailbox or the NCSC SERS.
- Track positive reporting rate as your headline metric, not just click-through on simulations.
- Measure time to contain from report to resolution, and review it after every incident.
- Run quarterly table-top exercises so the response plan gets rehearsed, not just written down.
Pro Tip: Reward the first person to report a genuine phishing attempt, publicly if they're comfortable with it: positive reinforcement spreads faster than any policy memo.
AI-driven threats, deepfakes and the evolving threat surface
AI tools have made convincing phishing emails and voice or video impersonation far easier to produce, and concern about this is rising. The Cyber Security Breaches Survey 2025/2026 points to growing worry about AI-driven threats alongside persistently low training adoption in smaller organisations, a combination that leaves many SMEs exposed just as the threat is getting harder to spot by eye.
The practical response is a verification habit, not a detection trick. If a request to transfer money, share credentials or bypass a normal process arrives by voice note, video call or urgent message, staff should confirm it through a second channel before acting, a phone call to a known number, a message on an established internal channel, anything that doesn't rely on the same medium the request arrived through. Deepfake voice calls impersonating executives are no longer rare enough to dismiss as science fiction.
- Explain how AI tools can generate convincing phishing text, fake voices and video impersonation.
- Teach an out-of-band verification habit: confirm unusual requests through a second, separate channel.
- Run a short exercise reviewing AI-generated text or audio and discussing what gave it away.
- Give staff a direct escalation route for any suspected impersonation attempt, however small it seems.
Designing delivery: cadence, engagement and avoiding common pitfalls
How training gets delivered matters almost as much as what's in it. A mix of formats works better than relying on any single method: short e-learning modules for core concepts, a handful of live or table-top sessions for scenario practice, and regular microlearning nudges (a two-minute video, a quick quiz) to keep the material fresh between formal sessions.
Cadence should follow a simple rhythm rather than a single event. Cover core topics during onboarding, then deliver role-specific tracks and plan regular refreshers. Consult the ICO's guidance when planning data protection training.
Phishing simulations deserve particular care in how they're rolled out. The NCSC is clear that punitive simulations, the kind that name and shame people who click, tend to erode trust rather than build resilience, and recommends involving HR from the outset to keep the tone blameless and constructive.
- Onboarding: cover phishing, passwords, MFA and reporting for every new starter.
- Weeks 2 to 12: role-specific tracks run for finance, HR, admin and technical staff.
- Regularly: run a short refresher module and table-top exercises.
- Programme review: review the full programme, including phishing simulations designed with HR input.
Pro Tip: Treat every simulation result as a training opportunity, not a disciplinary one: the goal is more reports next quarter, not fewer clicks this one.
Our onboarding checklist gives IT managers a ready-made structure for slotting this cadence into a wider onboarding plan.
How a managed IT partner assembles these topics into a programme
Turning a topic list into a working programme usually comes down to sequencing and follow-through. A sensible structure starts with a 30 to 90 day onboarding period covering the universal basics, moves into an 8 to 12 week role-based training track for finance, HR and technical staff, then settles into quarterly refreshers and an annual governance review that checks the whole programme still matches current threats.
Awareness training works best alongside technical controls, not instead of them. Remote monitoring and management catches the issues staff can't see; conditional access policies limit the damage a single compromised login can do; and a properly configured Outlook "Report Phishing" add-in turns staff vigilance into something IT can act on immediately rather than hearing about days later.
We support this pairing with resources on phishing simulations and Microsoft 365: training that teaches the behaviour, and technical setup that supports it. Mapping training outcomes back to a care plan, who got trained, who reported what, where the gaps are, gives a clear escalation pathway rather than a pile of certificates nobody revisits.
Why practical topics and culture beat theoretical lists
The programmes that actually reduce risk rarely cover the most topics; they cover the right five well: phishing reporting, password and MFA hygiene, device basics, data handling, and a visible incident process. Everything else layers on top once those stick.
Measurement matters more than coverage. A long syllabus with no reporting data is a wish list, not a programme. Balancing people, process and technology beats leaning on any one of them alone, since a brilliant filter still needs a human willing to report what slips through.
If resources are tight, start with reporting and phishing awareness. Everything else can follow once that habit is in place.
— Will
Getting an awareness programme that actually sticks
Building the list of topics is the easy part. Keeping a programme running, tracked and updated as threats shift is where most organisations run out of time, which is exactly the gap our managed IT support is built to close.
As part of a care plan, we handle the technical side that supports awareness training: configuring the Outlook reporting add-in, setting up conditional access, and keeping Microsoft 365 environments locked down so the habits staff learn have somewhere safe to land. Our managed IT support wraps monitoring and cybersecurity into one fixed monthly fee, so there's no separate invoice every time a policy needs reviewing.
- We set up and maintain phishing reporting routes, conditional access policies and Microsoft 365 security settings.
- We provide ongoing monitoring, so technical issues can be caught between annual reviews.
- We offer fixed monthly pricing through our care plans, with no hidden costs for ongoing support.
If you'd like a look at where your current training sits against this checklist, get in touch and we'll talk through what a programme for your team could look like.
FAQ
What are the 5 C's in security?
There is no single, universally agreed "5 C's" framework in security awareness training; definitions vary by organisation and context. Most versions focus on practical themes such as credentials, caution with communications, compliance, containment and culture, but treat any specific list as a memory aid rather than an official standard.
What are some important topics for security training?
The core topics worth prioritising are phishing and reporting, password and MFA hygiene, device and remote working security, data protection, and incident reporting. Role-specific content for finance, HR and IT admin staff, plus emerging areas like AI-driven threats and OAuth risks, rounds out a well-balanced programme.
What is the most important security awareness topic?
Phishing and social engineering sit at the top of most priority lists, since phishing remains the most common attack type reported by businesses and charities that experienced a breach. Teaching staff to report suspicious messages quickly matters more than teaching them to spot every single one.
What are the most important security awareness topics for 2026?
Alongside the established basics of phishing, passwords and data protection, 2026 priorities include AI-generated phishing and deepfake impersonation, OAuth and app consent risks in collaboration tools, and verification habits for unusual requests. The Cyber Security Breaches Survey 2025/2026 points to rising concern about AI-driven threats as a reason to fold these into existing training rather than treat them as a separate add-on.
How often should security awareness training be repeated?
Data protection training should be refreshed regularly. Consult ICO guidance when setting the interval between sessions. Broader security awareness content benefits from shorter, more frequent microlearning touches between those formal refreshers rather than a single annual event.