Your organisation’s cyber defences are only as strong as the people using them. Even with world-class technology, a single mistake can open the door to a breach. That’s why ongoing, role-specific staff training is essential — and a key requirement under the ST4S framework.

That’s why ongoing, role-specific staff training is essential and a key requirement under the ST4S framework.

Why Staff Training Matters

• Human error remains the #1 risk — Phishing, credential theft, and accidental data sharing still account for the majority of breaches.

• Threats evolve rapidly — Cybercriminals now use AI to personalise attacks, making them harder to detect. This is only going to get worse!

• Compliance depends on it — ST4S and Privacy Act 2020 obligations require proactive measures to protect personal and sensitive data.

Training isn’t a “once and done” activity. Roles change, technology changes, and so do the attack methods. Your programme should combine initial onboarding, quarterly refreshers, and continuous awareness activities.

Ideas:

1️⃣ Policies, Rules & Procedures (ST4S: Governance & Security Policy)

Staff need to understand your Acceptable Use, BYOD, and Password policies.

• Enforce strong password rules and MFA at the system level.

• Communicate consequences for policy breaches.

• Apply least privilege access — only give staff the permissions they need.

2️⃣ Malware & Phishing Awareness (ST4S: Threat Protection)

Educate staff on:

• Identifying suspicious links, attachments, and login pages.

• Risks from AI-generated phishing emails and deepfake video/audio scams.

• Avoiding downloads from untrusted sources and using only approved software.

3️⃣ Protecting Company Information (ST4S: Data Handling)

• Encrypt sensitive data in transit and at rest.

• Implement a clean desk and secure disposal policy for physical records.

• Clarify storage and sharing rules for electronic files, including USB drives and cloud systems.

4️⃣ Secure Use of Devices & Networks (ST4S: Endpoint Security & Remote Access)

• Company-managed devices must have EDR, up-to-date patches, and enforced screen locks.

• Staff should use VPNs on public Wi-Fi and avoid unapproved personal devices for work.

• Lost/stolen devices must be reported immediately so they can be remotely wiped.

5️⃣ Social Media & Digital Footprint (ST4S: Privacy Protection)

• Outline what can and cannot be shared publicly about the organisation.

• Encourage staff to lock down personal privacy settings to reduce the risk of targeted attacks.

6️⃣ Incident Reporting (ST4S: Incident Response)

• Make it easy and stigma-free to report suspected security incidents.

• Provide a clear escalation process, including after-hours contacts.

• Reinforce that early reporting can limit damage.

How to Deliver Effective Training

• Use real-world examples from your sector to make scenarios relatable. Fear does work well.

• Run simulated phishing campaigns to test awareness.

• Offer role-specific modules, e.g., finance teams on invoice fraud, developers on secure coding.

• Blend formats: short videos, live workshops, microlearning, and quick policy refreshers.

Final Thought

A security-aware culture is built through repetition, relevance, and leadership support. When staff see security as part of their job and not that of the tech team you strengthen your organisation’s resilience against modern threats.