In short: A cyber security quiz for employees is a short set of questions that checks whether staff know the key habits: spotting phishing, using strong passwords and MFA, handling data and AI tools safely, protecting devices and reporting problems quickly. Use it to start conversations and find gaps, not to catch people out.
Questions 1 to 4: phishing and fraud
- An email from a well-known delivery company says a parcel could not be delivered and asks you to pay a small redelivery fee by card. What should you do? Do not click the link. Check deliveries through the company's own website or app, typed in yourself, and report the email using your organisation's report button. A request for an unexpected small payment is a classic lure.
- A supplier emails to say their bank details have changed and asks you to update them before paying this month's invoice. What is the safe next step? Verify the change by contacting the supplier using contact details you already hold, not those in the email, and follow your payment-change procedure. Changed bank details are the heart of business email compromise.
- True or false: if an email shows a colleague's name and photo, it must be from them. False. Display names and photos are easy to fake, and real accounts can be compromised. Judge the request, not just the sender: is it unexpected, urgent or unusual?
- Where in the UK can you forward a suspicious email, and where can you forward a scam text message? Suspicious emails can be forwarded to the NCSC at report@phishing.gov.uk, and scam texts to 7726. At work, use your internal reporting route first. See how to report a phishing email.
Questions 5 to 8: passwords, MFA and AI
- Which is the strongest approach for a new work password: your child's name plus the year, a common word with letters swapped for numbers, or three random words? Three random words, which is the NCSC's advice, ideally stored in a password manager. Names, years and character swaps are among the first things attackers try.
- At 11pm your phone shows a sign-in approval request you did not start. What should you do? Deny it and report it. It means someone has your password and is trying to get in, possibly by sending repeated prompts in the hope you approve one. Change your password as IT advises. See password and MFA training.
- Someone from 'IT support' messages you on Teams and asks you to read out the code that has just been sent to your phone. Should you? No. Never share a one-time code with anyone, including IT. Genuine IT staff will not ask for it. Report the message.
- You want to use a free AI chatbot to summarise a client contract. Is that acceptable? Not unless the tool is approved for that use. Client contracts are confidential, and information entered into a public AI service may be visible to the provider. Use your organisation's approved tool and follow its rules. See safe use of AI at work.
Questions 9 to 12: devices, the office and reporting
- You find a USB stick labelled 'Salaries' in the car park. What should you do? Do not plug it in. Hand it to IT. Curiosity is exactly what an attacker is counting on. See physical security awareness.
- You are working in a café and need to step away for a moment. What should you do with your laptop? Take it with you. A locked screen helps, but an unattended device can be stolen in seconds.
- You realise you have just emailed a spreadsheet of customer details to the wrong person. What now? Report it straight away to your manager, IT or data protection lead. A personal data breach may need to be assessed and, in some cases, reported to the ICO within 72 hours of the organisation becoming aware of it, so speed matters. You will not be in trouble for reporting promptly.
- True or false: if you click a link in a phishing email by mistake, it is best to keep quiet so you do not get into trouble. False. Report it immediately. A fast report lets IT reset passwords and contain any damage. In a good security culture, people are thanked for reporting mistakes.
How to use the quiz
A quiz works best as a conversation starter rather than a test with consequences. Some ways to use this one:
- Run it in a team meeting and discuss the answers together, especially the ones people disagree on
- Put three questions in each month's staff newsletter, with answers the following month
- Use it as a team competition during Cyber Security Awareness Month, scoring teams rather than individuals
- Ask new starters to try it at the end of their security induction
- Use the questions people get wrong to choose the next training topic
For more engagement ideas, see security awareness ideas and activities.
How training platforms use quizzes
Most security awareness training builds quizzes into the lessons rather than treating them as a separate test. Some examples:
| Training | How quizzes are used |
|---|---|
| NCSC Top Tips for Staff (free) | A short e-learning course that ends with a quiz; if you load it into your own LMS you can set the pass rate. See free security awareness training |
| HacWare | Micro-training videos followed by short pop quizzes, sent automatically, plus security newsletters |
| usecure uLearn | A baseline knowledge check across core security areas shows each user's gaps, then training is assigned automatically to close them. Its custom course builder also lets you write your own quiz questions |
Quiz results show where knowledge is weak, but they do not prove behaviour has changed. Pair them with phishing simulation and report-rate data, as explained in measuring security awareness training.
How we help
We can turn questions like these into a branded quiz for your staff, build it into a year-round security awareness training programme and use the results to target the topics your people find hardest.
Contact us for a quiz and training programme tailored to your organisation.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What questions should be in a cyber security quiz for employees?
Cover the habits that matter most: recognising phishing and payment fraud, strong passwords and MFA, never sharing one-time codes, safe use of AI tools, protecting devices, physical security and, above all, how and when to report a problem.
Can we use this quiz with our staff?
Yes. The questions on this page are original and written for general use. Adapt them to your own reporting routes, tools and policies so the answers match how your organisation works.
Should quiz results be used to discipline staff?
No. Quizzes are for learning and for finding gaps in training. Using them to punish people discourages honesty and reporting, which are the behaviours you most want to encourage.
How often should staff take a security quiz?
Short quizzes after each training module, plus an occasional team quiz for engagement, work well. Many platforms add a question or two after each lesson automatically.