October is Cyber Security Awareness Month, but for us, awareness isn’t about how much cyber security information you can give employees. It’s about whether they know what to look out for and what to do when something doesn’t look right.
Phishing emails aren’t always easy to spot. They can look like Microsoft 365 notifications, document-sharing requests, supplier emails or messages from colleagues. They are designed to fit into a normal working day.
So what happens when someone does click?
A phishing incident in practice
One recent incident involved a customer in the professional services sector. The customer wasn’t using our managed SOC service, so the incident came to us through their usual support channel rather than through a security alert.
It started with a call to our service desk.
An employee had received what looked like a Microsoft 365 notification asking them to view a document. They clicked the link and entered their login details. Shortly afterwards, they became suspicious and contacted the service desk.
1. The service desk escalated it
The service desk engineer spoke to the employee, established what they had clicked and recognised that this needed to be treated as a potential security incident.
The ticket was escalated to our security team so we could establish whether the employee had simply entered their credentials into a phishing site or whether those credentials had already been used.
2. The security team investigated
Our security team reviewed the user’s recent sign-in activity and identified a login that was outside their usual pattern.
The account was treated as compromised and the focus moved immediately to containment.
3. We secured the account
The user’s active sessions were revoked and their password was reset.
The team then reviewed the account for any activity following the suspicious login. This included checking mailbox and forwarding rules, recent email activity and whether anything unusual had been sent from the account.
4. We checked for wider activity
The investigation then moved beyond the individual account.
We checked whether other users had received similar emails, whether anything had been sent internally from the compromised account and whether there were signs of further suspicious activity within the customer’s environment.
Once those checks were completed, the incident was contained and the customer was advised on the findings.
5. We went back to the original email
The phishing email itself wasn’t particularly obvious.
It looked like a Microsoft 365 notification and asked the employee to do something they regularly did as part of their job: open a document and sign in.
The employee recognised afterwards that something didn’t look right and contacted the service desk. Because they reported it, the issue could be escalated and investigated quickly.
Where awareness training comes in
This incident is a good example of why cyber security awareness isn’t just about stopping people from clicking.
Of course, we want employees to recognise phishing attempts before they enter their credentials. But we also want them to know what to do if they think they’ve made a mistake.
In this case, the employee reported it.
We would much rather somebody contact the service desk and find there is nothing to worry about than say nothing and allow a compromised account to go unnoticed.
That’s one of the behaviours cyber security awareness training should reinforce: recognise it, question it and report it.
Awareness needs to be ongoing
Cyber security awareness can’t be a once-a-year exercise. Threats change, new people join and good security habits need to be reinforced.
Short, regular training keeps security front of mind and helps employees recognise the situations they are likely to face, from phishing emails and suspicious login pages to unusual payment requests.
The aim is to build awareness continuously, so knowing when to stop, question and report becomes part of the working day.
Building better security habits
Technology and security monitoring provide essential protection, but there’s still a person sitting in front of the email, Teams message or login screen.
Our approach to Cyber Security Awareness Training is to help employees understand their role without expecting them to become cyber security experts.
It’s about building everyday security habits and giving people the confidence to question something that doesn’t look right.
It also means creating the right culture around reporting. Employees shouldn’t be reluctant to raise a concern because they’re worried they may have made a mistake.
The earlier something is reported, the sooner it can be investigated.
Make cyber security awareness part of the working day
Cyber Security Awareness Month is a useful opportunity to put security back on the agenda, but awareness can’t stop at the end of October.
HCS Cyber Security Awareness Training helps organisations build awareness across their teams through practical, recurring training focused on the cyber threats employees can encounter in their day-to-day work.
The objective is straightforward: help your people recognise potential threats, make better decisions and know when to report something.
