In short: Security awareness training for manufacturing teaches office, shop-floor and engineering staff the habits that protect production: spotting phishing and supplier invoice fraud, using shared terminals safely, handling USB drives and remote access for machines, and reporting anything odd. Short, practical modules and team briefings reach staff without a desk or a mailbox.
Why manufacturers are a target
Manufacturing and engineering firms combine several things attackers value:
- Downtime pressure: when production stops, there is strong pressure to pay or to restore quickly, which makes ransomware attractive; see ransomware awareness training
- Large supplier networks: frequent invoices and orders make payment diversion and fake supplier emails easier to hide
- Valuable designs: drawings, specifications and customer contracts are worth stealing
- Connected machines: production equipment, sensors and control systems increasingly connect to office IT and the internet
- Third-party access: machine builders and maintenance contractors often need remote access to equipment
- Shared devices: terminals on the shop floor, in the warehouse or at goods-in are often used by many people
Most of these risks start with a person: a click on a fake invoice, a reused password, a USB stick from an unknown source or an unexpected remote session that nobody questions.
Reaching shop-floor and non-desk staff
Many awareness programmes assume every user has a laptop and a mailbox. In manufacturing that is rarely true. Practical ways to reach everyone:
- Short modules: a few minutes at a time, on a phone or a shared terminal; HacWare, for example, uses videos of up to three minutes followed by a one-question quiz
- Toolbox talks: a five-minute security point in an existing shift briefing, with a sign-in sheet as the record
- Posters and screen savers near shared terminals, clocking-in points and canteens; see our security awareness ideas
- Separate learning paths for desk-based and shop-floor staff, so nobody sits through content that does not apply to them
- Content in more than one language where your workforce needs it: Sophos Phish Threat offers training in nine languages, HacWare in English and Spanish, and Hornetsecurity e-training in multiple languages
Most platforms enrol users from Microsoft Entra ID or Google Workspace. If some staff have no mailbox or user account, ask us how a platform handles them before you choose; for some teams, a group session recorded on a sign-in sheet is the right answer.
Supplier invoice fraud and purchasing
Purchase ledger and procurement staff see a steady stream of supplier emails, which makes them a prime target for payment diversion. Train them on these scenarios:
| Scenario | What staff should do |
|---|---|
| A supplier emails new bank details for future payments | Verify on a phone number already on file, never one in the email, before changing anything |
| An invoice arrives from a real supplier's address but the reply goes elsewhere | Check the reply-to address and report anything unusual |
| A 'director' asks for an urgent payment to secure materials | Follow the normal approval process and confirm through a separate channel |
| A customer's account appears to send a purchase order with a link to 'view' it | Treat links and attachments with care and report if in doubt |
| A courier or freight message asks for a fee or a sign-in | Check the shipment through your own system, not the link |
Our business email compromise training page covers payment diversion and verification procedures in depth.
Where operational technology meets IT
Operational technology (OT) is the equipment that runs physical processes: machines, controllers and the systems that supervise them. The NCSC's operational technology guidance notes that OT is increasingly connected to enterprise IT and the internet, which brings efficiency and new vulnerabilities. Training cannot secure a control system, but people's habits decide whether office threats reach the shop floor:
- USB drives: only use approved, scanned media to move files or updates to machines; never plug in a drive that has been found or handed over by a stranger; see physical security awareness
- Engineering workstations and machine terminals: do not use them for email, web browsing or personal devices
- Remote access: know who is allowed to connect to equipment and question an unexpected remote session or request to open access
- Visitors and contractors: escort them and check they are expected, especially near production systems
- Report odd behaviour: a machine acting strangely or a screen showing unexpected activity should be reported, not just restarted
Training sits alongside technical controls such as segmented networks, secure remote access for third parties and endpoint protection on the IT side. Our sister sites cover zero trust network access and Sophos Intercept X endpoint protection.
A practical programme for a manufacturing firm
A programme that fits around shifts and production schedules:
- Baseline: run a phishing simulation for staff with mailboxes and a short knowledge check for everyone else.
- Split the audience: office and management, purchasing and finance, engineering and maintenance, and shop-floor or warehouse staff.
- Core habits for all: phishing, passwords and MFA, USB drives, visitors and reporting; see password and MFA training.
- Role-based modules: payment verification for purchasing and finance, remote access and USB procedures for engineering and maintenance.
- Regular touches: short monthly modules or toolbox talks, and simulations varied by theme, such as fake invoices, delivery notices and supplier portals.
- Induction: cover security in the first week for new starters, temporary and agency staff; see security induction training.
- Review: report trends to management each quarter and adjust the next quarter's topics.
Our guide to building a security awareness training programme includes a 12-month calendar you can adapt to shift patterns.
Choosing a platform
The right platform usually depends on what you already run:
- Acronis backup and security customers: Acronis Security Awareness Training, powered by Wizer and enabled from the Acronis Cyber Platform console
- Sophos Central customers: Phish Threat, with training in nine languages
- Firms wanting automation: usecure or HacWare, which enrol, train and remind users with little admin
- Smaller firms wanting one security platform run for them: Guardz, which we provide as a managed service
- Webroot endpoint customers: Webroot Security Awareness Training
Compare them on our platforms compared page or browse the vendors hub.
How we help manufacturers
We design separate paths for office, engineering and shop-floor staff, theme simulations on the supplier and delivery emails your teams really receive, provide toolbox-talk material for teams without a desk, and report progress to management. Our managed security awareness training service runs it all for you, alongside email security, MFA and endpoint protection.
Contact us to discuss training for your sites.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do shop-floor staff need cyber security training?
Yes, but a different kind. Staff who use shared terminals, handle USB drives, sign in visitors or work near connected machines need short, practical guidance on those habits and on how to report anything odd. They rarely need the full office curriculum.
How do you train staff who do not have an email address?
Options include short modules on a shared terminal or phone, five-minute toolbox talks in shift briefings with a sign-in sheet as the record, and posters near clocking-in points. Ask us how a specific platform handles users without a mailbox before you choose.
Does security awareness training cover operational technology?
It covers the human habits that protect OT: approved USB media, keeping engineering workstations off email and the web, questioning unexpected remote access, escorting contractors and reporting unusual machine behaviour. Securing the control systems themselves needs technical controls as well.
Can training be delivered in other languages?
Yes, depending on the platform. Sophos Phish Threat offers training in nine languages, HacWare in English and Spanish, and Hornetsecurity offers e-training in multiple languages. Tell us which languages your workforce needs and we will check the options.
What is the biggest people risk for manufacturers?
Payment diversion and ransomware both commonly start with a convincing email, so purchasing, finance and anyone with a mailbox should be the first priority. Verifying bank-detail changes on a known number is one of the most valuable habits to train.