In short: Good security awareness ideas make security social and positive: short lunch-and-learns, a monthly newsletter with real examples, a network of security champions, team-based leaderboards, eye-catching posters, tabletop exercises and recognition for people who report phishing. Combine them with regular training and simulations, and plan a themed month such as October.
Start with the right mindset
Engagement activities only work if staff trust the programme. Three principles make everything else easier:
- Celebrate reporting, not just low click rates: the person who reports a real phishing email first deserves a thank-you
- Make it relevant: use examples from your sector and your own tools, not generic stock scenarios
- Keep it short and frequent: a few minutes each month beats an hour once a year
These ideas build a positive security culture rather than a 'gotcha' one. They also give you more to show the board than course completion figures.
Ideas for talking about security
Conversation is often more memorable than a module.
| Idea | How to run it |
|---|---|
| Lunch-and-learn | Thirty minutes, informal, food provided. Topics people care about personally work well: protecting family accounts, spotting online shopping scams, safe use of AI |
| Phish of the month | Share a real (sanitised) phishing email that was reported, and walk through the warning signs |
| Monthly newsletter | Three short items: a recent scam, one practical tip and a thank-you to reporters. Some platforms, such as Breach Secure Now and HacWare, include ready-made newsletters |
| Leadership moments | A director talks for two minutes at an all-hands about a phishing email they nearly fell for. It shows that anyone can be targeted |
| Ask-me-anything | A session with IT or your managed security provider where staff can ask anything, including about home security |
Security champions
A champions network puts a friendly, informed person in each team or site. Champions are not security experts; they are colleagues who are interested, approachable and willing to pass things on.
- Ask for volunteers from every department and location, including frontline and non-desk teams.
- Give them a short briefing each month and early sight of upcoming campaigns.
- Ask them to share tips in team meetings and to encourage reporting.
- Use them as a feedback channel: which training is confusing, which policies get in the way.
- Recognise them publicly and in appraisals, so the role is valued.
Champions are particularly useful in organisations with shift workers or several sites, where central messages do not always land.
Gamification, competitions and posters
A little competition helps, as long as it does not shame individuals.
- Team leaderboards for training completion and phishing reports, rather than naming individual clickers
- Quiz competitions between departments, using questions like those in our cyber security quiz for employees
- Spot the phish challenges with a small prize for the best explanation of the warning signs
- Posters and screen savers with one message each: report suspicious emails, lock your screen, deny unexpected MFA prompts
- Recognition for the first person to report each simulated or real phishing campaign
Rotate posters and messages every month or two, as people quickly stop noticing them.
Exercises and hands-on activities
Practising a response is far more memorable than reading about it.
- Tabletop exercises for managers and leadership: walk through a ransomware attack or a payment fraud scenario and decide who does what. The NCSC's free Exercise in a Box is a good starting point
- Report-button drives: make sure every user has and knows the report button, then track reports in the next simulation
- Clean desk walk-rounds: a friendly, anonymous check with a team score rather than names
- New-starter buddy chats: a champion spends ten minutes with each new joiner on how to report problems; see security induction for new starters
- Family online safety sessions: help staff protect their children and older relatives, which builds goodwill and good habits at work
A themed month and a year-round calendar
October is widely used for awareness campaigns, as it is Cybersecurity Awareness Month in the United States and European Cybersecurity Month across the European Union. It is a useful anchor even for UK organisations, but the same plan works in any month. Our Cyber Security Awareness Month page sets out a ready-made four-week plan with weekly themes, a simulation, a quiz and a report-button push.
Then spread activities across the year in your security awareness training programme, and track their effect with the measures in how to measure security awareness training.
Contact us and we will build an engaging year-round calendar and run it for you as part of our managed security awareness training.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How do you make security awareness training fun?
Keep it short, make it relevant to people's work and home lives, add team competitions and quizzes, celebrate people who report phishing, and include conversations such as lunch-and-learns rather than relying only on online modules.
What are good security awareness activities for October?
Run a themed week for each topic, such as phishing, passwords and MFA, safe use of AI and reporting. Add a phishing simulation, a team quiz, a report-button push and a short message from leadership. Our Cyber Security Awareness Month page has a full four-week plan.
What is a security champion?
A security champion is a volunteer in a team or site who shares security tips, encourages reporting and passes feedback to the security or IT team. Champions do not need to be experts; they need to be approachable and interested.
Should phishing simulation results be shared on a leaderboard?
Not by name. Team-level results, and especially reporting rates, are fine and can motivate people. Naming individual clickers damages trust and discourages people from reporting their mistakes.
How much time should staff spend on security awareness each month?
A few minutes of training plus occasional simulations and reminders is enough for most staff, with extra role-based training for finance, IT and leadership. Regular short touches work better than a long annual session.