CYBERSECURITY AWARENESS TRAINING-IN-A-BOX

Turn Your Employees From a Cybersecurity Risk Into an Active Line of Defense.

Your organization may have:

Firewalls.

Antivirus.

Endpoint protection.

Multi-Factor Authentication.

Backups.

Email security.

Cybersecurity policies.

But one convincing phishing email can still reach an employee.

One weak password can expose an account.

One careless file-sharing decision can expose sensitive information.

One unauthorized application can create a new security risk.

One employee can approve an MFA request they did not initiate.

One person can send confidential information to the wrong recipient.

And one employee who notices something suspicious—but does not know how to report it—can allow a small security event to become a serious incident.

Technology matters.

But employees also need to know:

WHAT TO RECOGNIZE → WHAT TO AVOID → WHAT TO PROTECT → WHAT TO REPORT → WHAT TO DO NEXT.

The GavelBrains Cybersecurity Awareness Training-in-a-Box is a premium, ready-to-implement cybersecurity awareness system designed to help organizations build practical security awareness across employees, managers and higher-risk roles.

It goes beyond a once-a-year presentation.

It helps you build an ongoing:

EDUCATE → SIMULATE → REINFORCE → REPORT → MEASURE → IMPROVE

security-awareness program.

Imagine This Scenario

It is 10:17 a.m.

An employee in Finance receives an email apparently from the Managing Director:

“I need you to process this payment urgently. I'm in a meeting, so don't call. Use the attached bank details.”

The email looks professional.

The signature is correct.

The request sounds urgent.

The employee is under pressure.

What happens next?

Does the employee:

process the payment immediately?

reply to the message?

open the attachment?

verify the request through another approved channel?

report the message to the security team?

The answer may determine whether the organization experiences a Business Email Compromise incident.

This is why cybersecurity awareness should not be limited to:

“Don't click suspicious links.”

Employees need practical judgment.

Build Security-Conscious Behaviour — Not Just Training Completion

Many organizations measure awareness like this:

98% of employees completed cybersecurity training.

That is useful.

But it does not automatically answer:

Can employees recognize phishing?

Do they know how to report suspicious activity?

Do they understand MFA fatigue?

Do they protect sensitive information appropriately?

Do remote workers understand basic security expectations?

Do managers know how to respond to reported incidents?

Are risky behaviours actually decreasing?

The toolkit helps move awareness from:

COMPLETION

toward:

BEHAVIOUR + REPORTING + RISK REDUCTION.

1. Cybersecurity Awareness Foundations

Build a practical employee-awareness program around real workplace risks.

Training areas can include:

✓ Phishing

✓ Social engineering

✓ Password security

✓ MFA

✓ Data handling

✓ Remote work

✓ Device security

✓ Cloud collaboration

✓ Mobile security

✓ Physical security

✓ Incident reporting

✓ AI-related security awareness

✓ Third-party interactions

The objective is not to turn every employee into a cybersecurity engineer.

It is to help employees make safer everyday decisions.

2. Understand Human Cyber Risk

Cybersecurity incidents frequently involve human actions.

But the objective of awareness should not be:

“Blame the employee.”

A better question is:

“How do we design an environment where secure behaviour is easier, expectations are clear, and suspicious activity is reported quickly?”

Human risk can be influenced by:

Urgency

Authority

Curiosity

Fear

Trust

Routine

Distraction

Workload

Poorly designed processes

Understanding these factors makes awareness training more realistic.

3. Phishing Awareness

Employees should understand how phishing attempts may try to manipulate them.

Common warning signs can include:

✓ Unexpected requests

✓ Urgency

✓ Suspicious links

✓ Unusual attachments

✓ Requests for credentials

✓ Requests for money

✓ Unexpected account alerts

✓ Sender inconsistencies

✓ Pressure to bypass normal procedures

But employees should not depend on one clue alone.

Modern phishing can look highly professional.

The more important skill is learning when to:

STOP → VERIFY → REPORT.

Scenario: Fake Microsoft 365 Login

An employee receives:

“Your Microsoft 365 password expires today. Click here to keep your account active.”

The page looks almost identical to the real sign-in page.

The employee enters their username and password.

Seconds later, they realize something may be wrong.

What should they do?

The employee should know how to:

report the event quickly;

avoid hiding the mistake;

provide useful information;

and follow the organization's incident procedure.

Fast reporting can be more valuable than pretending the incident never happened.

4. Business Email Compromise Awareness

BEC can target:

Finance.

Executives.

HR.

Procurement.

Accounts Payable.

Sales.

Employees with payment authority.

The toolkit helps organizations train employees to recognize scenarios involving:

✓ Urgent payment requests

✓ Changed bank details

✓ Executive impersonation

✓ Vendor impersonation

✓ Payroll diversion

✓ Confidential document requests

✓ Gift-card scams

Scenario: Vendor Bank Details Changed

Accounts Payable receives an email from a familiar supplier:

“We have changed banks. Please use the attached account details for all future payments.”

The email appears legitimate.

Should the employee simply update the account?

A stronger business process may require verification through an independently established channel before sensitive financial details are changed.

Cybersecurity awareness works best when combined with secure business processes.

5. Password Security

Employees need practical password guidance rather than vague instructions.

Awareness can reinforce:

✓ Unique credentials

✓ Approved password practices

✓ Password managers where organizationally approved

✓ Credential confidentiality

✓ Avoiding password reuse

✓ Secure password resets

✓ Reporting suspected compromise

✓ Never sharing credentials through inappropriate channels

The central message:

YOUR PASSWORD IS AN AUTHENTICATION SECRET — TREAT IT LIKE ONE.

6. Multi-Factor Authentication Awareness

MFA can significantly strengthen authentication.

But employees need to understand how to use it safely.

Training should cover:

✓ MFA prompts

✓ Authentication methods

✓ Unexpected requests

✓ Device changes

✓ Reporting suspicious MFA activity

✓ Never approving requests simply to stop notifications

MFA Fatigue Scenario

A user receives:

10 authentication approval requests in 20 minutes.

Eventually, they approve one just to make the notifications stop.

That single action may provide an attacker with the access they need.

Employees should understand:

AN MFA PROMPT YOU DID NOT INITIATE MAY BE A SECURITY SIGNAL.

7. Social Engineering

Attackers do not always use technology first.

They may use people.

Examples include:

“I'm from IT. I need your password to fix your account.”

“I'm the CEO's assistant. Send this confidential file immediately.”

“I'm the new employee. Can you reset my access?”

“I'm from your internet provider. Install this remote-support tool.”

The toolkit helps employees understand how attackers may exploit:

authority;

urgency;

trust;

fear;

helpfulness.

The defensive principle is:

VERIFY IDENTITY BEFORE PROVIDING ACCESS OR INFORMATION.

8. Data Classification & Information Handling

Employees need to know that not all information should be treated identically.

Organizations may classify information into categories such as:

Public

Internal

Confidential

Restricted/Sensitive

depending on their own classification model.

Training can help employees understand:

✓ Storage

✓ Sharing

✓ Transmission

✓ Printing

✓ Disposal

✓ External collaboration

✓ Cloud services

✓ Removable media

The goal is to connect classification to everyday behaviour.

Scenario: Wrong Recipient

An employee intends to email a confidential spreadsheet to:

[email protected]

but accidentally selects:

[email protected].

The message is sent.

What happens next?

The employee should know:

REPORT QUICKLY.

Trying to hide the error may increase the risk.

Awareness training should encourage prompt reporting rather than fear-driven silence.

9. Secure Cloud Collaboration

Employees increasingly collaborate through:

Microsoft Teams;

SharePoint;

OneDrive;

Google Workspace;

and other cloud platforms.

Training can cover:

✓ External sharing

✓ Public links

✓ Guest access

✓ Sensitive documents

✓ Collaboration permissions

✓ Approved storage

✓ File ownership

Scenario: “Anyone With the Link”

An employee needs to send a document to a consultant.

They choose the easiest sharing option:

“Anyone with the link.”

The consultant receives the file.

But what happens if that link is forwarded?

Employees need to understand the security implications of different sharing approaches.

10. Remote Working Security

Remote work changes the working environment.

Employees may use:

home networks;

hotels;

airports;

shared offices;

client sites.

Awareness can reinforce:

✓ Approved devices

✓ Secure connectivity

✓ Screen privacy

✓ Physical device security

✓ MFA

✓ Confidential conversations

✓ Approved applications

✓ Incident reporting

Remote Work Scenario

An employee is working in a busy airport.

They leave their laptop open on the table while buying coffee.

The device may be locked with a password.

But physical security still matters.

Cybersecurity extends beyond software.

11. Mobile Device Security

Phones and tablets can contain:

business email;

authentication applications;

documents;

cloud access;

contacts;

corporate applications.

Training can cover:

✓ Device locking

✓ Updates

✓ Approved applications

✓ Lost devices

✓ Public charging considerations

✓ Sensitive information

✓ Mobile phishing

✓ Reporting

Scenario: Lost Phone

An employee loses a phone containing:

Microsoft Authenticator;

business email;

Teams;

and corporate applications.

Should they wait two days to see whether the phone appears?

No.

The organization needs timely reporting so appropriate protective actions can be considered.

12. Removable Media & USB Security

USB devices can create:

malware risk;

data-loss risk;

unauthorized copying;

information leakage.

Employees should understand organizational rules around:

✓ Approved media

✓ Unknown USB devices

✓ Sensitive data

✓ Encryption where applicable

✓ Reporting

13. Software & Shadow IT

An employee discovers a free online application that makes their work easier.

They upload customer data.

The application has not been approved.

This creates Shadow IT.

Employees should understand why organizations may require approval before:

installing software;

connecting cloud applications;

uploading business information;

or using unapproved services.

Convenience should not silently create unmanaged risk.

14. AI Security Awareness

Generative AI creates new productivity opportunities—and new information-security questions.

Employees may paste:

customer information;

internal reports;

source code;

contracts;

employee information;

strategic documents

into public AI services.

The toolkit helps organizations establish awareness around:

✓ Approved AI tools

✓ Sensitive information

✓ Confidentiality

✓ Output verification

✓ Hallucinations/errors

✓ Copyright considerations

✓ Human review

✓ AI-related incidents

AI Scenario

An employee wants AI to summarize a confidential customer contract.

They paste the complete agreement into an unapproved public AI platform.

The output is useful.

But the security question is:

WAS THE INPUT APPROPRIATE?

AI awareness should address both productivity and information governance.

15. Physical Security

Cybersecurity is not entirely digital.

Employees should understand risks involving:

✓ Tailgating

✓ Visitor access

✓ Unattended devices

✓ Printed documents

✓ Clean desks

✓ Shoulder surfing

✓ Lost access cards

✓ Secure disposal

Tailgating Scenario

An employee enters the office using their access card.

A stranger carrying several boxes says:

“Can you hold the door for me?”

The polite response may create a security problem.

Employees need a safe way to challenge or redirect unauthorized access without creating unnecessary confrontation.

16. Incident Reporting

One of the most important outcomes of security awareness is:

EMPLOYEES KNOW HOW AND WHEN TO REPORT.

Possible reportable events include:

✓ Suspicious email

✓ Lost device

✓ Unexpected MFA request

✓ Credential exposure

✓ Malware warning

✓ Accidental data sharing

✓ Suspicious phone call

✓ Unauthorized software

✓ Physical-security concern

Employees should know:

WHERE TO REPORT.

WHAT INFORMATION TO PROVIDE.

WHAT NOT TO DO.

Build a “Report Early” Culture

Employees sometimes hide security mistakes because they fear punishment.

That can make incidents worse.

A mature awareness message should emphasize:

“If something looks wrong, report it quickly.”

Security teams can investigate faster when employees communicate promptly.

17. Role-Based Security Awareness

Not every employee faces identical risk.

The toolkit helps you develop targeted awareness for groups such as:

Finance

BEC, payment fraud and bank-detail changes.

HR

Employee information and social engineering.

Executives

Impersonation and targeted phishing.

IT Administrators

Privileged credentials and remote access.

Developers

Secrets and secure development practices.

Customer Support

Identity verification and customer information.

Remote Workers

Device, network and physical security.

Role-based training makes awareness more relevant.

18. New Employee Security Onboarding

Security awareness should begin early.

A new employee security checklist can cover:

✓ Acceptable use

✓ Password practices

✓ MFA

✓ Phishing

✓ Information classification

✓ Approved applications

✓ Remote working

✓ Incident reporting

✓ Device responsibilities

✓ AI-use requirements

The employee should understand security expectations before handling sensitive information.

19. Manager Security Toolkit

Managers influence employee behaviour.

The Training-in-a-Box can help managers reinforce:

✓ Reporting

✓ Access changes

✓ Employee offboarding

✓ Secure data handling

✓ Policy expectations

✓ Third-party interactions

✓ Escalation

Cybersecurity should not be communicated only by the security department.

20. Security Awareness Campaign Calendar

Instead of one annual training event, build a recurring program.

For example:

JANUARY — Password & MFA Security

FEBRUARY — Phishing

MARCH — Data Handling

APRIL — Remote Work

MAY — Business Email Compromise

JUNE — Mobile Security

JULY — Social Engineering

AUGUST — Cloud Sharing

SEPTEMBER — Incident Reporting

OCTOBER — Cybersecurity Awareness Month Campaign

NOVEMBER — Vendor & Holiday Fraud

DECEMBER — Year-End Security Review

Regular reinforcement helps keep cybersecurity visible.

21. Microlearning Content

Employees are busy.

Not every awareness activity needs to be a one-hour course.

The toolkit supports short educational formats such as:

✓ 5-minute lessons

✓ Security tips

✓ Posters

✓ Email reminders

✓ Short videos

✓ Quizzes

✓ Scenario cards

✓ Team discussions

✓ Security newsletters

The objective is repeated exposure to useful behaviours.

22. Phishing Simulation Program

Authorized phishing simulations can help organizations evaluate awareness.

A structured program should consider:

✓ Objectives

✓ Authorization

✓ Target population

✓ Scenario difficulty

✓ Ethical considerations

✓ Privacy

✓ Reporting

✓ Remediation

✓ Trends

The objective should be:

EDUCATION AND RISK REDUCTION — NOT HUMILIATION.

Measure More Than Click Rates

Suppose:

12% of employees clicked a simulated phishing link.

That metric is useful.

But also ask:

How many reported it?

How quickly?

Which departments struggled?

Which scenario types caused problems?

Did performance improve after training?

A mature awareness program uses multiple indicators.

23. Build Awareness Metrics

Possible measures include:

✓ Training completion

✓ Quiz results

✓ Phishing simulation outcomes

✓ Phishing reporting rate

✓ Reporting speed

✓ Repeat failures

✓ Department trends

✓ Security incidents involving human actions

✓ Campaign participation

✓ Role-based training completion

Metrics should help answer:

“Is employee security behaviour improving?”

24. Build a Human-Risk Dashboard

The toolkit helps management visualize:

Training completion

Phishing reporting

Simulation trends

High-risk departments

Overdue training

Repeat-risk patterns

Security-reporting activity

Improvement actions

This moves awareness from:

“HR sent the annual course.”

to:

“Management can see how the human-risk program is performing.”

25. Link Awareness to Policies

Training should reinforce organizational requirements.

Relevant policies might include:

✓ Acceptable Use

✓ Information Security

✓ Password & Authentication

✓ Data Classification

✓ Remote Working

✓ Incident Reporting

✓ AI Acceptable Use

✓ Access Control

Employees should understand both:

THE RULE

and

THE PRACTICAL BEHAVIOUR EXPECTED.

26. Link Awareness to Incident Response

Security awareness can improve incident detection.

Employees may be the first people to notice:

a suspicious email;

unexpected MFA;

lost device;

unusual system behaviour;

accidental disclosure.

That means employees are part of the organization's detection capability.

The connection becomes:

EMPLOYEE OBSERVES → EMPLOYEE REPORTS → SECURITY ASSESSES → INCIDENT PROCESS ACTIVATES.

27. Build a Security Champion Program

Some organizations may benefit from security champions within departments.

Champions can help:

reinforce awareness;

share security updates;

encourage reporting;

provide feedback;

identify department-specific risks.

Security champions should complement—not replace—the professional security team.

28. Executive Awareness

Executives can be high-value targets.

Executive awareness may focus on:

✓ Spear phishing

✓ Impersonation

✓ Sensitive communications

✓ Travel security

✓ Privileged access

✓ Payment fraud

✓ Data handling

✓ Incident escalation

Seniority should not create exemption from cybersecurity controls.

29. Measure Program Effectiveness

At the end of a campaign cycle, ask:

Did employees learn?

Did behaviour change?

Did reporting improve?

Did high-risk patterns decrease?

Which groups need more support?

What incidents occurred?

What should next year's program emphasize?

Awareness should operate as a continuous improvement cycle:

BASELINE → EDUCATE → SIMULATE → MEASURE → REINFORCE → IMPROVE.

THE COMPLETE TRAINING-IN-A-BOX

The GavelBrains Cybersecurity Awareness Training-in-a-Box can help you build a complete internal program containing:

Employee Training Materials

✓ Phishing awareness

✓ MFA security

✓ Password security

✓ Social engineering

✓ Data handling

✓ Remote working

✓ Mobile security

✓ Cloud sharing

✓ Incident reporting

✓ AI security awareness

Campaign Resources

✓ Monthly awareness calendar

✓ Security tips

✓ Email campaign ideas

✓ Posters

✓ Microlearning topics

✓ Scenario exercises

Management Resources

✓ Awareness-program charter

✓ Roles and responsibilities

✓ Human-risk dashboard

✓ Management reporting

✓ Program review framework

Assessment Resources

✓ Knowledge checks

✓ Employee quizzes

✓ Scenario assessments

✓ Training completion tracker

✓ Phishing simulation tracker

✓ Remediation tracker

Operational Resources

✓ New employee security checklist

✓ Incident-reporting guide

✓ Manager checklist

✓