Phishing and information security training for staff
Short answer
Information security training teaches employees how to recognise phishing, social engineering and other attacks and what to do if they suspect one. Short, regular units with realistic examples and a culture in which reporting is rewarded rather than punished work best. Whether there is a legal duty depends on the NIS2 transposition, contracts and standards, among other things; it makes sense in every company.
Key points
- People are a frequent entry point — and also effective reporters.
- Short, regular units work better than one annual compulsory video.
- Reporting must be easy and must not have negative consequences.
- Simulated attacks need clear rules and transparency.
- NIS2 requires training for management bodies and encourages it for staff.
Why information security training?
Many successful attacks start not with a technical flaw but with a message: an email announcing an invoice, a call supposedly from IT, a text with a parcel-tracking link. Technology filters out a lot, but never everything. Employees who recognise and report attacks are therefore an important part of defence.
At the same time, information security is more than phishing. Secure passwords and multi-factor sign-in, handling mobile devices and storage media, locking the screen, behaviour when travelling and working from home are all part of it.
Legal and contractual framework
The NIS2 Directive (EU) 2022/2555 requires in Art. 20(2) that members of the management bodies of entities in scope follow training, and that Member States encourage entities to offer similar training to their employees on a regular basis. Art. 21 lists basic cyber hygiene practices and cybersecurity training among the risk-management measures. National transposition sets out the details; whether a company is in scope depends on sector and size.
Many contracts, insurance policies and standards also require information security training. The international standard ISO/IEC 27001, for example, contains requirements on awareness and training. And under Art. 32 GDPR, organisational measures for the security of processing are an obligation of every controller. This overview is not legal advice.
Content that counts
Good training focuses on what employees actually encounter and on clear actions.
- Recognising phishing: check the sender, urgency, unusual requests, links and attachments.
- Social engineering: calls, visitors, fake executives, payment instructions under time pressure.
- Sign-in: long passphrases, password managers, multi-factor sign-in, no sharing.
- Devices and data: screen lock, storage media, working on the move, private devices.
- Suspected incident: What do I do if I clicked? Whom do I tell, and how fast?
- Using AI tools: never enter confidential data into services that have not been approved.
Formats and rhythm
Security knowledge fades quickly, and attack patterns change. An annual mandatory course as a foundation makes sense; it becomes more effective with short refreshers throughout the year: a five-minute unit on a current scam, an example from your own organisation, a short quiz.
Good training shows real examples — redacted, but recognisably from your own environment. It practises decisions rather than terms: “This email supposedly comes from the managing director and asks for an urgent transfer. What do you do?”
Simulated phishing attacks: handle with care
Many companies send simulated phishing emails as exercises. Used well, they can train recognition. Used badly, they destroy trust: when click rates of individuals are passed to managers, when employees are exposed, or when simulations imitate genuine, important messages so that legitimate emails get ignored in future.
Proven principles: announce openly that exercises happen; evaluate results only in aggregate; after a click, show a short learning unit instead of making a note; visibly recognise the reporting of suspicious emails. Where a works council exists, involve it; data protection must be observed too.
Organisation and records with Universe
Universe's People Development area includes the template “Information security and phishing”, valid for 12 months by default — interval and legal basis are suggestions. The course can be assigned automatically to everyone; additional short units on new scams can be created as extra learning paths.
Courses are built in the course workshop, also from existing slides, and include quizzes to check understanding. On completion there is a signed certificate with a verification code; the refresher starts automatically 30 days before expiry. Simulated phishing campaigns are not part of the platform's features.
Step by step
Define core training
A short mandatory module for everyone covering the main attack patterns and the reporting route.
Simplify reporting
Set up an easy route for suspicious messages and make it known.
Plan refreshers
Schedule short units on current scams throughout the year.
Agree rules for exercises
Before simulated attacks, clarify purpose, evaluation and the involvement of works council and data protection.
Involve leadership
Train management and managers first and visibly.
Terms
- Phishing
- Fraudulent messages intended to trick people into revealing credentials, opening malicious attachments or making payments.
- Social engineering
- Manipulating people to gain access to information or systems.
- Multi-factor sign-in
- Signing in with at least two independent factors, such as a password and a one-time code.
Frequently asked questions
How often should employees be trained on phishing?
An annual core course is common; it becomes more effective with short refreshers during the year, especially when new attack patterns appear.
Are simulated phishing emails permitted?
They can generally be used but touch on data protection and, where applicable, co-determination. Transparent rules, aggregated evaluation and involving the works council are important. Have the specific case checked legally.
What should employees do if they clicked a phishing link?
Inform IT or the designated team immediately, hide nothing and enter no further data. The faster the report, the smaller the damage. The company should make clear that quick reporting is welcome.
Do managing directors need training too?
For entities within the scope of NIS2, the directive explicitly requires training for members of management bodies. Regardless, executives are a favoured target of attacks and should learn alongside everyone else.
How it works in Universe
Related articles
- Mandatory training at work: overview and organisationWhich mandatory training companies must provide, where the obligations come from, and how to organise assignment, refreshers and records properly.
- Organising data protection training for employeesOrganising data protection training for staff: target groups, content per role, rhythm, comprehension checks and records that support GDPR accountability.
- Compliance training: topics, structure and effectivenessWhat compliance training covers, which topics matter for whom, how to build it on a risk basis, and how to tell whether it is more than a box-ticking exercise.
- Refresher intervals for mandatory training: an overviewWhich refresher intervals for briefings and training are actually written in German law and accident prevention rules — and where it only says “regularly”.