Everyone Needs Cybersecurity Training — Even Your Tech-Savvy Staff

Who in your firm would you skip if you were booking cybersecurity training?

If the honest answer is “the younger ones, they’ll be fine”, you’ve just described the person an attacker would start with.

Fluent with technology is not the same as secure

Someone who grew up with smartphones can navigate half a dozen apps without thinking, work across three devices and sort out everyday tech problems in seconds. None of that means they’ll recognize a phishing email, notice a fake Microsoft 365 login page or understand why reusing one password puts the whole business at risk.

Those are two different skills. One comes from using technology every day. The other has to be taught, and refreshed, because the tricks change.

Why targeting the “less technical” people backfires

We see this in businesses across the GTA. Training gets pointed at whoever the owner thinks is most likely to click something, and everyone else is expected to pick it up on their own.

But everyone has a different gap. One person spots a suspicious email instantly and uses the same password everywhere. Another has excellent password habits and approves an unexpected sign-in request on their phone because it looks familiar. A senior partner would never click a strange link, but forwards a “client” document to accounts without checking the sender.

Criminals don’t care how old anyone is or what their title says. They want the first person who trusts something they shouldn’t.

Training has to match how your people actually work

A lot of work in professional firms now happens on a phone: approving sign-in prompts on the GO train, opening documents on a personal device, replying to email between client meetings, switching between business and personal apps all day.

Each of those moments is a chance for a mistake that didn’t exist a few years ago. Good awareness training walks people through those exact situations so they recognize them before they become a problem.

The real goal is a culture where checking is normal

The point of training isn’t a passed quiz. It’s that someone who receives an unexpected invoice or an MFA prompt they didn’t trigger feels comfortable stopping to ask before they continue. A two-minute question is always cheaper than a recovery.

Start here:

• Train every person in the business, not a subset, and repeat it at least yearly.

• Include phone-based scenarios: MFA prompts, text messages, mobile email.

• Run occasional simulated phishing emails so people practise safely.

• Make “I wasn’t sure, so I checked” something people get thanked for.

When the whole business trains together, everyone ends up speaking the same language about risk, from the newest hire to the managing partner. That’s what keeps one confident click from becoming everybody’s problem.

Got an IT question like this one? Talk to the team that wrote the article — no ticket number required. Book a free consultation.