Module 9 · 9.2
English
Awareness in your team
Module 9: Rules and organisation · Reading time: 9 minutes
Learning objective: After this lesson, you can organise awareness in a small team: agreements, reporting without blame, practising and repeating.
Key concepts: awareness, behaviour, reporting culture, phishing exercise (with consent and without punishment), new employee, short refresher
Knowing is not the same as doing
Almost everyone knows you shouldn't click on suspicious links. Yet it happens every day, even to people who know better. That's not because of stupidity. It's because a phishing email (lesson 1.2 and module 3) plays exactly on how we work: pressure, haste, the wish to help a customer or colleague. On a Friday afternoon at a quarter to five, among thirty other emails, an "outstanding invoice" looks completely normal.
Awareness is therefore not just about knowledge, but about behaviour: what do people actually do, even when they're tired or in a hurry? The goal isn't for everyone to become an expert. The goal is a few fixed reflexes:
- Stop when a message asks for something: money, a password, a click, opening an attachment, installing something.
- Check through another channel: log in yourself instead of following the link, call back on a known number.
- Report if something seems off, even if you've already clicked.
That third reflex is the most important, and it depends entirely on how your team handles it.
Reporting without blame
Imagine two companies. At the first, an employee who clicked a phishing link gets an angry reaction from the owner: "How could you be so stupid?" At the second, the owner says: "Good thing you told me straight away, we can change your password now."
What happens the next time someone clicks? At the first company, they keep quiet and hope for the best. At the second company, they report it within five minutes.
That difference is huge. In the case of an account takeover or the start of ransomware, hours matter (lesson 1.3 and 3.5). A report within five minutes means: changing the password before the attacker has logged in, revoking sessions, taking a computer off the network before anything is encrypted. A report after three weeks, or never, means the attacker has had all the time in the world.
A good reporting culture has a few characteristics:
- One clear point of contact. Everyone knows who to go to: a name and a phone number, and a backup person if that person is unavailable. This is also on the incident card (lesson 8.1).
- Thank, don't punish. Anyone who reports something, even their own mistake, gets a thank you. Say it out loud in the team: "Sarah reported a fake invoice this morning, which meant we could warn the others."
- Doubt is fine too. "I don't know if this is genuine" is a good report. Better to have a genuine email checked ten times than miss one fake email.
- Leading by example. If the owner themselves reports that they nearly fell for something, it makes it easier for everyone.
Punishment backfires. Not because mistakes aren't a problem, but because punishment doesn't reduce the number of mistakes, only the number of reports.
Agreements that make behaviour easy
People follow a rule more readily when it's clear and easy. Make sure safe behaviour is also the easiest behaviour. A few agreements that fit almost any small business:
| Agreement | Why |
|---|---|
| Payments and changed account numbers always with a callback and a second person (lesson 1.2) | A fake email is then not enough to transfer money |
| Passwords only in the password manager, never in email or chat (lesson 2.2) | No passwords in mailboxes that could be leaked |
| Two-factor authentication on all business accounts (lesson 2.3) | A leaked password isn't enough on its own |
| No software installed without consultation (lesson 5.2) | Less chance of infostealers and ransomware |
| A lost phone or laptop reported immediately (lesson 5.2) | Remote wiping and revoking sessions |
| Never "just this once, outside the procedure", not even for the director | CEO fraud relies on exactly this |
Write the agreements on a single sheet of paper. Not twenty pages of policy no one reads, but a list that could hang next to the coffee machine.
Practising
An agreement you never practise, you forget. There are various ways to practise, from light to heavy.
Looking at examples together. Take five minutes during a team meeting for a genuine suspicious email someone received (without personal data). What gave it away? What was the real domain of the link? This costs nothing and works surprisingly well, because it's about real messages in your own mailbox.
A tabletop exercise. You discuss a scenario together: "It's Monday morning and no one can access the network drive anymore. Every PC shows a ransom message. What do we do?" You go through the incident card and see where it falls short (lesson 8.1). An hour, once a year.
A phishing exercise. You send colleagues a simulated phishing email to see who clicks and who reports it. This can be instructive, but only if you do it properly:
- With consent and announced in advance. Tell people beforehand that exercises will take place this year, without naming the date. No one should feel deceived afterwards.
- Without punishment. Anyone who clicks gets a brief explanation straight away of what gave it away, not a reprimand and not a list of names in the team meeting.
- Measure what counts. The number of reports matters more than the number of clicks. An exercise in which three people click but five report it within ten minutes is a success.
- No nasty themes. No fake email about a bonus, redundancy or a colleague's health. That damages trust more than it's worth.
- Watch your privacy. Don't keep records of who clicked for longer than necessary, and never use it for a performance review.
For a team of five, the first form is often enough on its own. A phishing exercise is only worthwhile once the agreements and the point of contact are in place.
New employees and refreshers
Two moments are extra important.
The first working day. A new employee gets accounts, a laptop and access to systems. In those first few weeks especially, they don't yet know how things normally go, and therefore don't know what's unusual either. A scammer posing as "IT" or "the director" has a better chance then. Take half an hour at the start to go through the one-page agreements, the point of contact, the password manager and turning on two-factor authentication. Include this in the same checklist as the rest of onboarding (lesson 7.1).
Short refreshers. Awareness fades. One long training session a year works less well than five minutes every month. Ideas for such a short refresher:
- discuss a suspicious email from this month;
- highlight one agreement from the sheet and ask if it still works;
- a new type of fraud that was in the news (for example, a new trick via text message or WhatsApp, lesson 3.4);
- the question "has anyone reported anything this month?" and thanking whoever did.
In practice: what it looks like
An example, put together from situations that often occur. An architecture firm with nine people had a fourteen-page policy document that was signed on joining and never opened again. After a near-successful invoice fraud, they changed three things: a one-page sheet with six agreements by the printer, a fixed name and phone number to report to, and five minutes of "suspicious post" in the team meeting on the first Monday of every month. In the first six months, more reports came in than in the previous five years. Two of those were genuine attacks, spotted early enough that nothing happened. The rest were false alarms, and each one was simply thanked.
Summary
- Awareness is about behaviour: stopping, checking through another channel, and reporting.
- Reporting without blame leads to fast reports; punishment only reduces reports, not mistakes.
- Write agreements on a single sheet and make safe behaviour the easiest behaviour.
- Practise with real examples and a tabletop exercise; only run a phishing exercise if it's announced, without punishment, and with attention to privacy.
- Pay extra attention to new employees and repeat briefly and often.
Quiz
Exercise
Exercise D9.2: An awareness plan for your team. Create a one-page sheet for your own business with up to eight agreements, appoint a point of contact and a backup person, and plan when you'll run short refreshers and which exercise you'll do over the coming year. Then answer the reflection questions.
Exercise D9.2: An awareness plan for your team
Here's how to do it: (1) Write a maximum of eight agreements on a single sheet of paper (use the table in the lesson as a starting point: payment procedure, password manager, 2FA, no software without consultation, reporting loss, no exceptions outside the procedure). (2) Appoint a reporting point (name and phone number) and a stand-in. Put that at the top of the sheet. (3) Plan for the next twelve months: a fixed moment each month for five minutes of repetition, a tabletop exercise (lesson 8.1), and whether you'll run a phishing exercise. If so: how you'll announce it, that you won't punish people for it, what you'll measure (reports, not just clicks) and how briefly you'll keep the data. (4) Add half an hour of awareness training on the first working day to your list for new employees (lesson 7.1). (5) Discuss the sheet at your next team meeting and put it up.
Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.
Further reading
The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.
- Is this email really from WebOké? Recognizing phishing and using the promo code
- National Cyber Security Centre (NCSC), Phishing: https://www.ncsc.nl/phishing
- NCSC, Cyberveilig Check for sole traders and SMEs: https://tools.ncsc.nl/cyberveilig-check/
- Fraud Helpdesk (reporting fraud and phishing): https://www.fraudehelpdesk.nl