Security awareness training topics: the 40 to cover

Group 1: Scams and social engineering (7 topics)

The tricks that reach staff through a channel — email, SMS, phone, video — and the executive versions of them.

1. Social engineering — the levers behind every scam: authority, urgency, reciprocity
2. Phishing — email red flags and reporting; QR codes; AI-written phishing
3. Smishing — SMS and messaging-app scams: delivery fees, bank alerts, fake support
4. Vishing — phone scams, the callback rule, AI voice cloning
5. Online payments — changed bank details, invoice and CEO fraud, verifying payments
6. High-risk users — whaling and deepfake calls aimed at executives
7. Secure email use — autocomplete, BCC, attachments, auto-forwarding, encryption

Group 2: Passwords and accounts (3 topics)

1. The dark web — what happens to stolen data, and why password reuse matters
2. Password security — passphrases, password managers, no reuse, no sharing
3. Authentication — MFA, passkeys, never sharing a one-time code, MFA fatigue

Group 3: Devices and networks (11 topics)

1. Removable media — found USB sticks, “free” cables and chargers
2. IoT security — smart cameras, default passwords, updates, separate networks
3. Spyware and adware — malicious apps and extensions, permissions, stalkerware
4. Mobile device security — screen lock, updates, app stores, lost phones, QR codes
5. Home network security — router password, firmware, guest network
6. OS updates — keeping laptops and phones updated; don’t postpone restarts
7. Patching — apps, browsers and plug-ins; the company patch process
8. VPN awareness — what a VPN does and does not protect
9. Secure VPN use — the company VPN correctly; no personal VPNs
10. BYOD — personal devices for work: enrolment, separation, lost devices
11. Public Wi-Fi — fake hotspots, sign-in pages, your phone’s hotspot

Group 4: Data protection and privacy (6 topics)

1. Data loss — wrong recipients, autocomplete, lost laptops, open share links
2. Cloud security — sharing links and permissions; approved tools only
3. Third-party services — supplier impersonation; sharing with vendors
4. Information and data — classification, need-to-know, UAE and Saudi data-protection basics, public AI tools
5. Online privacy — oversharing, privacy settings, data brokers
6. Social media — work vs personal accounts, fake profiles and recruiters

Group 5: Threats and the safe workplace (13 topics)

1. Cyber criminals — who they are and how they make money; AI-assisted scams
2. Denial of service — what an outage attack looks like; extortion emails
3. Ransomware — how it starts, first minutes, don’t pay, report fast
4. Malware — attachments, macros, fake updates; signs and response
5. Malicious websites and apps — lookalike sites, fake downloads, cracked software
6. State-sponsored threats — politically motivated attacks, disinformation, supply chain
7. Secure internet use — browsing and download habits, public computers
8. Working remotely — home setup, shoulder surfing, locking the screen
9. Physical security — tailgating, visitors, fake couriers
10. Video conferencing — wrong windows, meeting links, deepfake guests
11. Security at home — family devices, children, shared accounts, smart home
12. Clear desk — desks, screens, printers, whiteboards
13. Insider threat — careless and malicious insiders, leavers, warning signs

How to spread 40 topics over a year

Match the order to your incidents, not to the table: if payment fraud hit you last month, start there. One to two short courses a month is a pace teams keep; a monthly rhythm also lets you slot in a new topic when something happens.

Common mistakes when choosing topics

• Buying 40 topics and switching them all on in week one — people skim, nothing sticks
• Skipping the “soft” topics (clear desk, security at home) — they carry real risk in offices and shared spaces
• Forgetting field and plant teams: their risks (portable media, shared logins) differ from office staff
• Never re-running a topic: repeat the scam group yearly; the tricks change with the seasons

How to use a list like this

Each of our courses is a 2–3.5 minute animated story with a scenario quiz — short enough to fit into a team meeting, in English and Arabic. Browse them by topic group: scams, accounts, devices, data, and threats and safe workplace.