In short: Security induction training is the short set of security lessons, policy sign-offs and account set-up steps a new employee completes in their first week. A good induction covers phishing, passwords and MFA, reporting and acceptable use, and is assigned automatically when the person's account is created through directory sync.
Why new starters are a target
People who have just joined an organisation are in an unusual position:
- They do not yet know which requests are normal, so a fake message from 'the finance director' or 'IT' is harder to judge
- They want to make a good impression and are reluctant to question senior colleagues
- Their new role is often public on professional networking sites, so criminals know who to target and when
- They are setting up accounts, MFA and devices, which is exactly when fake sign-in and set-up messages look plausible
That makes the first week the most valuable time to teach the basics, and the most important time to tell people it is always acceptable to check and to report.
A first-week security checklist
Use this as a starting point and adapt it to your policies:
- Day one: accounts. Set up MFA with the person present, explain number matching and never approving a prompt they did not start, and introduce the password manager.
- Day one: reporting. Show the report button in Outlook or Gmail and explain what happens when they use it. Make it clear that reporting a mistake is always welcome.
- Days one to three: core module. A short induction course covering phishing, social engineering, passwords, data handling and remote working.
- Days one to five: policies. Read and acknowledge the acceptable use, information security and data protection policies, with the sign-off recorded.
- Week one: role briefing. Finance, HR, IT and executive starters get the relevant role module, such as payment verification or help desk identity checks.
- Weeks two to four: first simulation. Include the new starter in the normal phishing schedule, with teaching on a click.
- End of probation: check-in. Confirm completion and refresh anything outstanding.
The topics map to our cyber security awareness training curriculum, and the role modules to security awareness training for employees.
Automating enrolment through directory sync
Manual enrolment is where induction programmes fail: someone forgets to add the new starter, and months pass. Most platforms we supply sync users from Microsoft Entra ID or Google Workspace, so a new account appears in the training platform automatically and can be enrolled in an induction course without anyone remembering to do it.
| Platform | New-starter automation |
|---|---|
| usecure uLearn | Auto Enrol adds new users from Microsoft 365 or Google Workspace and starts their training automatically |
| HacWare | New-employee training as part of its automated programme, with reminders and escalation if lessons are missed |
| Breach Secure Now | Weekly micro-training by email once a user is added, plus policies with e-signature in a brandable employee portal |
| Attack Simulation Training | Training campaigns can be assigned to users in Microsoft 365 without running a simulation first |
The same sync also helps when people leave: their training account is removed when their directory account is disabled, which keeps your reports accurate.
Acceptable use and policy sign-off
Induction is the natural moment to record that each person has read and accepted your key policies. Auditors, insurers and ISO 27001 assessors may ask for this evidence.
- Keep policies short and written in plain English, with the rules that matter most at the top
- Record who acknowledged which version and when, and re-collect sign-off when a policy changes
- Platforms such as usecure uPolicy and Breach Secure Now's policy module track acknowledgement for you
See information security awareness training for how policy acknowledgement supports ISO 27001, and GDPR training for staff for the data protection element.
Contractors, temps and returners
Give agency staff, contractors and people returning from long leave a shortened version of the induction: MFA set-up, the report button, the acceptable use policy and the core phishing module. Make sure their training enrolment ends when their account does.
Combine this with physical security awareness basics (badges, visitors, clean desk) if they will work on your premises.
How we help
As part of our managed security awareness training service we connect your platform to Microsoft 365 or Google Workspace, build the induction path and policy sign-offs, check that new starters are enrolled automatically, and report completion to HR and management each month.
Contact us to set up an automated induction for your new starters.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What should be included in a security induction for new employees?
MFA set-up and the rule never to approve an unexpected prompt, the password manager, how to report a suspicious message, a short core module on phishing and data handling, acceptance of the acceptable use and data protection policies, and any role-specific module for finance, HR, IT or executive starters.
How long should security induction training take?
Usually under an hour in total, spread across the first week. A short core module plus policy sign-off is enough to start; ongoing monthly lessons and simulations do the rest.
Should new starters be phished in their first week?
It is better to teach first and include them in the normal simulation schedule a few weeks later. A test before they have had any training mostly measures that they are new.
Can new starters be enrolled in training automatically?
Yes, on most platforms. With user sync from Microsoft Entra ID or Google Workspace, a new account can be enrolled in an induction course automatically, for example through usecure's Auto Enrol feature.