Phishing and Social Engineering Awareness Training
Complete Phishing and Social Engineering Awareness Training to recognize cyber threats, prevent attacks, and strengthen workplace cybersecurity awareness.
Duration
Lectures
Content
About This Course
Phishing and social engineering are still the easiest way into most organizations — one convincing email, text, or phone call can hand an attacker the credentials, data, or payments they’re after. This Phishing and Social Engineering Awareness Training teaches your employees to recognize those attacks in the moment and respond correctly, before a click turns into a breach.
In about an hour of self-paced learning, staff learn to spot phishing emails, fake login pages, smishing (text) and vishing (phone) scams, QR-code attacks, and MFA-fatigue tactics — then verify suspicious requests, protect credentials, and report incidents the right way. Every module uses real-world scenarios, so people practice on the kinds of messages they actually receive at work. As attackers increasingly use AI to scale their lures, staff can also see how these tactics are evolving in our guide to AI-powered phishing threats. The result is a workforce that makes your organization a harder target — and a measurable step toward a stronger security culture.
What You'll Learn
- Why phishing and social engineering work — and why attackers target people rather than systems
- How to recognize phishing emails, spoofed websites, malicious attachments, and QR-code scams
- How to spot manipulation tactics like urgency, authority, impersonation, and emotional pressure
- How to verify suspicious requests before sharing data, approving access, or making a payment
- Password and multi-factor authentication (MFA) best practices that resist account takeover
- Exactly what to do after clicking a suspicious link or receiving a phishing attempt
- How to report suspected phishing quickly to limit damage and protect your workplace
Requirements
- No prior cybersecurity experience required
- Basic computer and email skills are helpful but not essential
- Suitable for employees, managers, contractors, and remote workers at any level
- Any internet-connected device — computer, tablet, or smartphone
- A willingness to apply your organization’s cybersecurity policies day to day
This Course Includes
- Around 1 hour of self-paced training across 5 modules and 20 lessons (confirm duration)
- Downloadable cybersecurity checklists and awareness resources
- Practical phishing scenarios and real-world attack examples
- Knowledge checks to reinforce every module
- Full access on mobile and desktop
- One year of unlimited access to course materials (confirm access term)
- Professional Certificate of Completion
Who Is This Course For?
Built for anyone with a work inbox — and for the employers responsible for keeping them from clicking:
- Employees and managers across every department
- HR and finance teams targeted by payroll and invoice fraud
- Customer service staff handling inbound requests from strangers
- IT support and helpdesk staff who get impersonated in vishing calls
- Remote workers and contractors operating outside the office perimeter
- Employers rolling out security awareness consistently across a whole team
Volume pricing makes it practical to train everyone rather than a handful of people. It pairs naturally with the rest of our data privacy and cybersecurity training for a complete, audit-ready program.
Certification
Compliance and Regulatory Alignment
This training supports the people-focused side of recognized security frameworks and obligations:
- NIST cybersecurity awareness practices
- Phishing and social engineering prevention programs
- User verification and secure authentication requirements
- Incident reporting and escalation procedures
- Security awareness expectations under the FTC Safeguards Rule and state privacy laws
Documented, repeatable awareness training helps demonstrate that your employees are equipped to reduce human-related cyber risk.
Why Compliance Training Matters
Attackers target people because human error slips past technical defenses. Almost every successful attack comes down to one ordinary moment:
- An urgent email from someone who looks like the CEO
- A login page that’s one character off the real domain
- A QR code on an invoice nobody thought to question
- An MFA prompt approved just to make it stop
- A phone call from “IT” asking to confirm a code
A firewall can’t stop any of these. The decision happens in a person’s head, in a few seconds, under pressure. Awareness training is the control that changes that decision — staff who recognize the pattern, pause, verify, and report quickly are the difference between a blocked attempt and a breach.
Career Benefits
Cybersecurity awareness is now a baseline expectation in nearly every role. Employers look for people who can:
- Spot phishing and social engineering before acting on it
- Protect credentials, customer data, and confidential information
- Follow secure authentication and password practices
- Report suspicious activity through the right channels
- Work safely across email, chat, mobile, and collaboration tools
Completing this course strengthens those skills, adds a certificate to your professional record, and signals that you take the security of company systems and customer data seriously.
Course Curriculum
20 •1 Hour
1. Understanding Phishing and Social Engineering
-
1.1 What phishing is and why it matters
-
1.2 What social engineering means in workplace security
-
1.3 Why attackers target employees, not just systems
-
1.4 Business risks: data loss, fraud, malware, and account takeover
2. Recognizing Manipulation Tactics
-
2.1 Urgency, pressure, and fear-based messages
-
2.2 Authority scams and executive impersonation
-
2.3 Trust, curiosity, reward, and emotional triggers
-
2.4 How to pause, verify, and avoid rushed decisions
3. Email, Link, Attachment, and QR Code Threats
-
3.1 Suspicious senders, domains, and message patterns
-
3.2 Fake links, login pages, and credential theft
-
3.3 Unsafe attachments, downloads, and malware risks
-
3.4 QR-code phishing and brand impersonation scams
4. Phone, Text, MFA, and Collaboration App Scams
-
4.1 Smishing: phishing through text messages
-
4.2 Vishing: phone scams and fake IT support calls
-
4.3 MFA fatigue, verification code theft, and login approval abuse
-
4.4 Social engineering through Teams, Slack, social media, and mobile apps
5. Safe Response, Reporting, and Cybersecurity Habits
-
5.1 Password safety and multi-factor authentication best practices
-
5.2 Protecting company data, customer information, and work accounts
-
5.3 What to do after clicking, replying, scanning, or sharing information
-
5.4 Reporting suspicious activity and building a no-blame security culture
Frequently Asked Questions
It’s a short, self-paced online course that teaches employees to recognize and respond to phishing and social engineering — including email phishing, smishing (text), vishing (phone), QR-code scams, fake login pages, and MFA abuse — and to follow safe verification and reporting habits at work.
Anyone with a work inbox. It’s designed for employees, managers, HR and finance teams, customer service and IT support staff, contractors, and remote workers — and for employers rolling out security awareness across a team.
Yes. It covers email phishing, smishing, vishing, QR-code phishing, fake login pages, credential theft, and MFA-fatigue attacks — including how attackers now use AI to make their lures more convincing.
Report it immediately, follow your organization’s incident procedures, change any affected passwords, and notify your IT or security team as fast as possible. Quick reporting is what limits the damage — and the course walks through exactly what to do.
About one hour, self-paced, on any device, with one year of unlimited access so your team can start and finish on their own schedule.
Yes — volume discounts apply automatically: 10% off 5+ seats, 20% off 10+, 30% off 25+, and 40% off 50+. For larger teams, contact us for a custom order.
Yes. You’ll earn a professional Certificate of Completion recognizing your knowledge of phishing awareness, social engineering prevention, and workplace cybersecurity best practices.