Cybersecurity Training Works Best When Employees Know What to Do Next

Most employees have seen a phishing warning. They know to look for unusual links, unexpected attachments and messages that create urgency. Yet when a convincing message arrives during a busy workday, remembering the advice and acting on it are two different things. A message may look routine, appear to come from a senior colleague or arrive just as someone is rushing to meet a deadline.

That gap between awareness and action is worth addressing. In its 30 September 2026 release, the European Commission reported that 74% of EU employees had encountered suspicious emails, messages or links at work in the previous six months. Phishing was the most commonly reported threat, affecting 39% of respondents. The survey also found that only 48% felt able to recognize an AI-generated fake video.

ENISA's summary of the findings adds another important detail: only 45% of employees said their organization provided regular cybersecurity awareness updates, while 85% expressed interest in improving their skills. Lack of time was the most frequently reported barrier to training, cited by 26% of respondents. These results describe the EU workplace, but they raise a useful question for organizations everywhere: are employees being given the practice and support they need to act confidently?

Move beyond the annual awareness module

A completed course does not necessarily mean someone can respond appropriately under pressure. Employees need to practise the steps that matter in their actual working environment. If they encounter a suspicious message, do they know which reporting channel to use? Can they report it without forwarding the message to colleagues? If they have already clicked a link, do they know to report that immediately rather than quietly hoping nothing happens?

Training should make these decisions familiar before a real incident occurs. Short, scenario-based exercises can be more useful than long presentations when they reflect the tools and workflows employees use every day. Scenarios should cover more than obvious spelling mistakes: examples can include fake document-sharing invitations, impersonation of executives, fraudulent payment requests and AI-generated voice or video content.

The goal is not to turn every employee into an incident responder. It is to help people recognize when something feels wrong, take the correct next step and give the security team information it can act on.

Measure the behaviours that improve security

Organizations can make awareness programmes more meaningful by tracking practical outcomes alongside course completion. Useful indicators include:

• Reporting rate: How often do employees report suspicious messages through the approved channel?

• Time to report: How quickly are potentially harmful messages brought to the security team's attention?

• Reporting quality: Does the report include relevant details without spreading the suspicious content further?

• Repeat performance: Do employees apply the right process across different scenarios, including more convincing social engineering attempts?

These measures should support learning, not create a culture of blame. If employees fear embarrassment or punishment for reporting a mistake, they may delay disclosure. A prompt, clear reporting process and constructive feedback can help people raise concerns earlier.

Make learning part of the working routine

ENISA's Awareness Raising-in-a-Box resource offers guidance for organizations planning and implementing cybersecurity awareness activities. Its approach reinforces the value of designing awareness programmes deliberately rather than treating training as a once-a-year administrative task.

For Indonesian organizations, the practical lesson is to connect awareness with workplace procedures, accessible reporting channels and regular exercises. Employees need to know what to recognize, what to do and what happens after they report a concern. Security teams, meanwhile, need a process for responding to those reports and sharing useful lessons without exposing sensitive information.

ITSEC Cyber & AI Academy supports cybersecurity and AI skills development through structured learning. Building stronger cyber resilience starts with knowledge, but it grows through practice, feedback and the confidence to take the right action when it matters.

Develop practical cybersecurity and AI capabilities with ITSEC Cyber & AI Academy.

References

1. European Commission. Three in Four EU Employees Faced Cyber Threats at Work, New Eurobarometer Finds. Published 30 September 2026. Read the official release

2. European Union Agency for Cybersecurity (ENISA). Cybersecurity Month @ Work: Employees' Skills Under the Looking Glass. Published 30 September 2026. Read the ENISA summary