Topic 5: Employee Training, Human Error & Policies

Technology protections are vital, but educated employees are your primary defensive line. Establishing simple operational policies and educating staff on social engineering tactics goes a long way toward protecting your business from human error.
This Topic is an iceberg - 90% is below the surface.
- There are hundreds of threat variations, and there will be more by this afternoon.
- AI is now being used by the bad guys, delivering new, more believable vishing, smishing and other threat variants.
Education is the best protection. While this topic seems to be aimed at employees rather than the solopreneur, such is not the case. Everyone needs to understand and know how to deal with social engineering threats.

Items Ranked by Priority

These items address social engineering risks, financial safeguards, and operational culture.

1. Unprepared Staff Vulnerable to Phishing Emails

Why It’s a Threat: Phishing emails mimic trusted vendors, banks, or colleagues to trick staff into surrendering credentials or downloading malware attachments.

Real-World Example: A staff member opens an email labeled "Past Due Invoice" and opens the attached file named Invoice.docx. The file actually installs keylogger software on the user's computer.

Solution: Conduct short, ongoing awareness refreshers so staff learns to spot suspicious sender addresses, fake links, and urgent language.

2. Lacking Verification Rules for Wire Transfers & Banking Changes

Why It’s a Threat: Attackers send fake emails impersonating company owners or known suppliers with an urgent request to alter direct deposit numbers or send wire transfers.

Real-World Example: An accountant receives an urgent email appearing to come from the owner requesting an $8,000 wire transfer and sends the funds without calling the owner first.

Solution: Enforce a strict "two-person or phone-call verification" rule for any request to wire money or change vendor payment details.

3. Operating Without an Acceptable Use Policy

Why It’s a Threat: Without clearly written ground rules, employees may download unapproved utilities, stream unsafe media, or connect unauthorized hardware (Shadow IT) to office networks.

Real-World Example: An employee installs a free online PDF conversion tool off the web that carries adware that clogs local networks with pop-ups.

Solution: Provide a short, simple Acceptable Use Policy outlining clear expectations regarding software downloads, web browsing, and device care.

4. A Punitive Reporting Culture

Why It’s a Threat: A punitive reporting culture can discourage employees from reporting suspected phishing attempts, mistakes, and other potential security incidents. Reporting should be a documented part of security training. Employees must be taught what to look for, how to report it, and what immediate steps to take.
Employees should not be expected to know how to respond to a suspected phishing email if they have not been trained on the organization’s procedure. In that situation, the failure is a management and training failure—not necessarily an employee failure. Training records should document who received the training, when it was provided, and what procedures were covered.
If an employee received and understood documented training, failed to follow the established procedure, and did not promptly report the issue, the organization may conduct a review after the incident has been contained. That review should determine whether the employee knowingly or negligently disregarded the procedure and whether corrective action or sanctions are appropriate. The review should also consider whether the procedure was clear, accessible, and practical under the circumstances.

Real-World Example: An employee receives an email that appears unusual and may be a phishing attempt. The employee has not been trained on how to report suspected phishing messages and is unsure whether to delete the email, forward it to IT, or take another action. The employee’s uncertainty reflects a gap in the organization’s training and procedures.
If the employee had previously received documented training explaining the reporting procedure but failed to follow it, the organization could conduct a post-incident inquiry. Any sanctions should be based on the facts and applied only after the incident has been resolved.

Solution: Create a reporting culture that encourages immediate notification of suspected incidents. Management should provide clear, documented, and recurring training on reporting procedures. Employees should not be penalized for reporting an honest mistake or uncertainty in good faith. When an employee fails to follow a documented procedure, address the matter through a fair, post-incident review that distinguishes inadequate training from individual negligence or intentional misconduct.

5. Neglecting Periodic System Security Surveys

Why It’s a Threat: Business software, staff roles, and configurations change over time; operating without a periodic security audit leads to silent security gaps.

Real-World Example: A firm adds three cloud apps over two years but forgets to check whether MFA or automated backups were activated on those new tools.

Solution: Schedule a periodic System Security Survey to determine and document the organization's current security posture.