Who is responsible for cybersecurity in your business?
Your IT company?
The person responsible for IT?
Microsoft?
Your cybersecurity provider?
The answer is:
All of them.
But there’s another group that belongs on that list.
Every person who works for you.
That’s because your employees make security decisions every working day.
They open emails. Click links. Download files. Approve payments. Share information. Answer telephone calls. Use passwords. Access Microsoft 365. Connect devices. Let people into buildings.
And sometimes make mistakes.
Technology can protect against an enormous number of threats.
But good cybersecurity also relies on helping employees recognise situations where something simply doesn’t look right.
Attackers don’t always attack computers
When people imagine a cyberattack, they often picture somebody trying to break through a firewall or install malware.
Sometimes the easier target is the person sitting in front of the computer.
Imagine an employee receives an email:
Your Microsoft 365 password expires today.
There’s a button underneath:
KEEP CURRENT PASSWORD
The employee is busy. They have a meeting in five minutes. The email looks reasonably convincing.
They click.
They’re taken to something that looks remarkably like Microsoft’s login page.
They enter their email address and password.
Perhaps they’re then asked to approve an authentication request.
From the employee’s perspective, they’re just trying to stop their email account from expiring.
From the attacker’s perspective, something very different may be happening.
Phishing has become much more convincing
The stereotypical phishing email is easy to laugh at.
Poor spelling. Strange formatting. An unbelievable story. A mysterious prince urgently requiring your bank account.
Modern phishing can look considerably better.
Attackers can imitate Microsoft. Banks. Delivery companies. Suppliers. Accountants. Directors. Even people the employee genuinely knows.
And as we discussed in our article about supplier cybersecurity, sometimes the message can actually originate from a genuine account belonging to a trusted organisation that has itself been compromised.
That’s why telling employees:
“Don’t click suspicious emails.”
isn’t enough.
They need some idea of what suspicious actually looks like.
Your employees don’t need to become cybersecurity experts
This is important.
Cybersecurity training shouldn’t turn every employee into a junior security analyst.
Your Accounts Manager doesn’t need to understand malware reverse engineering.
Your receptionist doesn’t need to know how Conditional Access works.
Your sales team doesn’t need a lesson on cryptography.
They need practical knowledge that relates to the decisions they make.
For example:
- Does this email make sense?
- Was I expecting this document?
- Why am I being asked to log in?
- Why does this payment suddenly need different bank details?
- Why is this request so urgent?
- Why is somebody asking me for an authentication code?
- Should this person be following me through a secure door?
Most importantly:
Who should I tell if I’m not sure?
That’s useful security awareness.
The receptionist may be part of your physical firewall
Cybersecurity doesn’t stop at the computer screen.
Imagine somebody walks into your office carrying a laptop bag.
They look confident.
They tell reception:
“I’m here from IT. I’ve been asked to look at the network cabinet.”
Would they be challenged?
Would somebody verify the appointment?
Or would they be shown where the equipment is?
The same principle applies to somebody following an employee through a secure door.
Holding a door open feels polite. Usually it is.
But security sometimes requires employees to be comfortable asking:
“Sorry, who are you here to see?”
Physical security and cybersecurity increasingly overlap.
That free USB drive might not be a gift
Imagine an employee finds a USB memory stick in the car park.
It’s labelled:
SALARIES 2026
Curiosity is powerful.
What happens if they plug it into their work computer?
Unknown removable devices can present a security risk.
Again, the answer isn’t to expect employees to understand precisely how every possible USB-based attack works.
The useful lesson is much simpler:
Don’t connect unknown devices to company computers.
That’s the sort of rule people can actually remember.
Finance teams deserve particular attention
Some employees are more attractive targets than others.
Finance teams can authorise payments. Senior managers can request them. HR holds sensitive employee information. IT staff may have privileged access. Executives have authority.
An attacker may tailor their approach accordingly.
Imagine somebody telephones Accounts claiming to be the Managing Director.
There’s a confidential acquisition underway. A deposit must be paid today. The MD is about to board a flight and can’t speak for long. Don’t contact anybody else because the transaction is commercially sensitive.
Every element is designed to create pressure:
Authority.
Urgency.
Secrecy.
Financial consequence.
The defence isn’t necessarily a piece of software.
It may be a well-trained employee who says:
“That’s not our payment process. I’ll verify this independently.”
That employee has just become a cybersecurity control.
AI makes social engineering even more interesting
Employees should also understand that convincing communication is becoming easier to create.
An unusual email can be rewritten into polished business English in seconds.
Information available publicly can help attackers make messages more relevant.
And synthetic audio, images and video mean that businesses should increasingly be cautious about relying solely on:
“It sounded like the boss.”
The answer isn’t paranoia. It’s process.
Significant financial or sensitive requests should have verification procedures that don’t depend entirely upon the apparent identity of the person making the request.
Training once a year isn’t ideal
Many organisations treat cybersecurity training as an annual compliance exercise.
Employees watch a long presentation. Answer some questions. Tick the box. See you next year.
The problem is that security threats don’t appear once a year.
People also forget things.
A better approach is generally to make security awareness regular, short and relevant.
A few minutes each month can reinforce subjects such as:
- Phishing.
- Passwords.
- Microsoft 365.
- Payment fraud.
- Physical security.
- Data handling.
- Remote working.
- Social engineering.
- Mobile-device security.
- New threats.
The objective isn’t to interrupt employees’ working lives with endless security courses.
It’s to keep sensible security behaviour familiar.
Test understanding as well as delivering training
There’s another useful element.
Simulation.
For example, organisations can run controlled phishing exercises.
Employees receive a safe simulated phishing message.
The exercise measures how people respond.
The objective shouldn’t be to catch people out or embarrass them.
It’s to answer questions such as:
- Are employees recognising phishing?
- Are particular types of message more effective?
- Do people know how to report suspicious emails?
- Is awareness improving over time?
That information can then guide future training.
If half the organisation struggles with a particular attack technique, that’s valuable information.
You’ve discovered the weakness during an exercise rather than during a real attack.
Don’t punish people for reporting mistakes
This may be one of the most important cultural elements of cybersecurity.
Imagine an employee clicks a link. Something doesn’t feel right.
They realise they may have entered their Microsoft 365 password into a fake website.
What happens next?
In one organisation, the employee thinks:
“I’m going to get in trouble.”
So they say nothing.
Perhaps the attacker now has hours or days before anybody investigates.
In another organisation, the employee immediately calls IT:
“I think I’ve done something stupid. Can you check?”
That’s a much better outcome.
The IT team can investigate. Credentials can potentially be changed. Sessions can be reviewed. The account can be checked for suspicious activity. Security systems can be examined.
Speed matters.
Your employees should therefore know:
Reporting a potential security mistake quickly is the right thing to do.
A culture where people hide mistakes can make incidents considerably harder to contain.
“I clicked it” can be extremely useful information
There’s a tendency to regard the employee who clicked the phishing email as the problem.
But consider what happens next.
They report it immediately. Your IT provider investigates. The malicious destination is identified. Other employees can be warned. Security systems can be checked. Similar messages may be found. Potential compromise can be investigated.
That employee may have provided the first indication that an attack is underway.
Humans aren’t simply a cybersecurity weakness.
They can also be sensors.
Give employees an easy way to ask for help
Security procedures fail when they’re too complicated.
If an employee receives something suspicious, what should they do?
Forward it somewhere? Create a ticket? Telephone somebody? Use a phishing-report button? Tell their manager?
If nobody knows, there’s friction at precisely the moment you don’t want it.
Employees should have a simple answer to:
“I’m not sure about this. Who do I ask?”
The easier you make reporting, the more likely people are to use it.
Cybersecurity training isn’t only about phishing
Phishing receives a lot of attention because it’s common and easy to demonstrate.
But security awareness should be broader.
Employees should understand the basics of:
Passwords and authentication
Why passwords shouldn’t be shared and why authentication requests should be treated carefully.
Company information
What information is sensitive and where it should be stored.
Remote working
How to work safely away from the office.
Physical security
Visitors, access cards, unlocked computers and tailgating.
Payment procedures
How unusual financial requests should be verified.
Devices
What can and can’t be connected to company equipment.
Reporting
How to report something suspicious or a mistake.
That’s a much more useful definition of cybersecurity awareness than simply:
“Don’t click phishing emails.”
Managers need training too
Seniority doesn’t provide immunity from cyberattacks.
In fact, senior employees can be particularly attractive targets.
They may have:
- Access to sensitive information.
- Authority to approve transactions.
- High-level Microsoft 365 privileges.
- Publicly available information about their role.
- Assistants who respond to requests on their behalf.
Executives can also be busy.
And busy people sometimes make quick decisions.
Security awareness therefore needs to apply to everybody.
Including the Managing Director.
A cybersecurity programme where employees complete training but directors quietly exempt themselves sends entirely the wrong message.
Five questions to ask about your employees
If you’re responsible for IT within your business, ask:
- Do all employees receive regular cybersecurity awareness training?
Not just when they first join. - Do we test whether that training is actually working?
For example, through appropriate simulations and assessments. - Do employees know how to report something suspicious?
The answer should be simple. - Would an employee feel comfortable admitting they’d clicked something they shouldn’t?
Culture matters. - Are senior managers and directors included?
Cybersecurity applies to everyone.
If you’re unsure about any of those answers, there may be an opportunity to improve.
Technology still matters enormously
None of this means responsibility for cybersecurity should simply be handed to employees.
Quite the opposite.
People should be supported by good technology.
Email protection should filter threats. Endpoint security should protect computers. Identity controls should protect accounts. Threats should be monitored. Backups should protect data. Access should be appropriately controlled.
Employees are one layer within that wider system.
The objective is that if technology misses something, a trained employee may recognise it.
And if an employee makes a mistake, the technology may still prevent that mistake becoming an incident.
That’s what layered security looks like.
Make employees part of the solution
Cybersecurity messages often describe employees as:
“The weakest link.”
We don’t think that’s particularly helpful.
Employees are the people running the business.
They’re also often the first people to see unusual emails, strange requests and behaviour that doesn’t feel right.
Give them useful training. Give them sensible procedures. Give them an easy way to report concerns. Support them with good security technology.
And make sure they know that quickly reporting a mistake is far better than hiding one.
Do that properly and your employees aren’t simply another cyber risk to manage.
They become part of your cybersecurity team.
How prepared are your employees?
Bitwise-IT provides managed IT and cybersecurity services to businesses across Essex and beyond.
Our approach combines technology, security monitoring and employee awareness because protecting a modern business requires more than simply installing antivirus software.
If you’re responsible for IT and aren’t sure how prepared your employees would be for phishing, payment fraud, social engineering or other common threats, we’re happy to have a conversation.
Because good cybersecurity doesn’t just protect your employees. It involves them.
