What Is Security Awareness Training?

Definition

Security awareness training teaches employees to recognize and report the scams and mistakes that lead to breaches: phishing emails, fake phone calls, suspicious payment requests, risky downloads, and careless handling of data. Good programs are short, regular, and practical, and they make reporting easy rather than shameful.

How It Works

A working program has a few parts:

• Baseline training for every new hire, covering phishing, passwords and MFA, payment fraud, and how to report something odd.
• Short refreshers through the year, built around current scams instead of an annual hour-long video.
• Simulated phishing to give people practice and to show where more coaching is needed.
• Role-specific training for finance staff who move money, admins with elevated access, and anyone who handles health or payment data.
• A clear reporting path, such as a report button or a single contact, with quick thanks for every report.

Some regulations require it outright. The FTC Safeguards Rule, which covers many small financial firms such as tax preparers and mortgage brokers, tells covered businesses to "provide your people with security awareness training and schedule regular refreshers." The HIPAA Security Rule requires training for all workforce members on security policies and procedures.

Training reduces risk; it does not eliminate it. Phone-based social engineering, deepfake voices, and well-researched emails can fool careful people, so training works best alongside technical controls such as phishing-resistant MFA and payment verification rules.

Real-World Example

The New York Department of Financial Services' October 2020 report on the July 2020 Twitter hack found that a 17-year-old and his accomplices used "basic techniques more akin to those of a traditional scam artist: phone calls where they pretended to be from Twitter's Information Technology department." Callers claimed to be from the help desk responding to VPN problems, which were common after the move to remote work, and steered employees to a phishing site that "looked identical to the legitimate Twitter VPN website." The hackers took over high-profile accounts and stole over $118,000 worth of bitcoin.

Why It Matters for a Small Business

In a small office, every employee is effectively on the security team, and many have access to email, banking, and customer data. One convincing call or email can lead to a wire transfer to a criminal or a stolen login. Training is also something insurers, regulators, and larger customers increasingly ask about. It is one of the few controls that improves every other control. Staff who know how to report a suspicious message quickly also give the business early warning, often before an attacker gets any further.

How to Spot It / How DTS Handles It

Warning signs: no training since onboarding, staff unsure how to report a suspicious email, payment changes approved over email alone, and help desk or vendor callers trusted without verification.

DTS can help with short, regular staff training and phishing tests, an easy way to report suspicious messages, and verification steps for payments and password resets. See our managed IT service, or our vCISO service for the wider security program.

Related Terms

• Phishing: the scam training targets most.
• Vishing: phone-based social engineering, as in the Twitter hack.
• Business email compromise (BEC): payment fraud that trained staff can stop.
• Social engineering: the wider category of manipulation.
• Security policy: the rules training teaches.
• Tabletop exercise: practice for leaders during an incident.
• Multi-factor authentication (MFA): the technical backstop when someone is fooled.

Sources

• New York State Department of Financial Services, Twitter Investigation Report (October 2020): https://www.dfs.ny.gov/reports-and-publications/other-reports/Twitter_Report
• FTC, FTC Safeguards Rule: What Your Business Needs to Know (December 2024): https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
• HHS, Summary of the HIPAA Security Rule: https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

---

Last updated October 14, 2026.