Summary (Key Takeaways)
- Being confident with apps and devices is a different skill from recognising phishing emails, counterfeit login pages and suspicious sign-in requests.
- Assuming younger or more digitally fluent staff need less training leaves gaps, because everyone in a firm has different blind spots, including senior staff.
- Attackers look for the first person who trusts something they shouldn’t, so a single weak point can expose client data, client money and the firm’s reputation.
- Training must reflect how people work now: on mobile phones, between meetings, on personal devices and while approving sign-ins on the move.
- The most effective protection is a whole-firm culture where pausing to check an unexpected email, payment request or login prompt is normal and encouraged.
The Assumption That Leaves Firms Exposed
In many professional firms there is an unspoken belief about cyber security training: the people who need it most are the ones who are least comfortable with technology. The newer, younger members of the team, who have grown up with smartphones, social media and a constant stream of apps, are expected to pick it up naturally.
It is easy to see where the assumption comes from. A trainee who can switch between three devices without a second thought, fix a problem with a shared calendar in seconds and set up a new app before anyone else has found the download button certainly looks capable. Surely they are the last people who need to be told how to stay safe online?
In practice, this is one of the more dangerous assumptions a firm can make. It shapes who gets trained, how seriously the training is taken, and where the firm believes its risk sits. And it is frequently wrong.
Confidence With Technology Is Not the Same as Security Awareness
Being good with technology and being good at cyber security are two separate skills. The first is about using tools efficiently. The second is about recognising when an apparently routine message is in fact an attempt to deceive you.
A person can move fluently between half a dozen apps and still click a link in a well-crafted email that appears to come from a client. They can be entirely proficient in Microsoft 365 and still enter their password into a fake login page that looks identical to the real thing. They can manage their personal accounts with ease and still not appreciate why reusing a password across work and personal services puts the whole firm at risk.
In some cases, confidence can even work against people. Someone who moves quickly and feels at ease with technology may be more inclined to act on autopilot: approving, clicking and replying without the brief pause that might have revealed something was wrong.
Everyone Has Different Blind Spots
Firms that tailor their training towards people they consider “less technical” tend to overlook a simple truth: everyone has gaps, they are just in different places.
A senior partner may have decades of experience spotting suspicious correspondence and instantly recognise a dubious email, yet use the same password for several systems because it is easier to remember. A paraplanner may have excellent password habits and a password manager, yet approve an unexpected multi-factor authentication request on their phone because it looks familiar and arrived at a busy moment. A receptionist may be careful with links but unaware of how convincingly criminals can now imitate a known contact’s writing style.
Passwords remain one of the most common weak points, and old or reused credentials can still open doors long after people have forgotten about them. We covered this in detail when we explained why old passwords are still unlocking business systems.
The point is not that any one group is worse than another. It is that no group is automatically safe, and training that targets only some people leaves the others to rely on luck.
Attackers Look for the First Person Who Trusts the Wrong Thing
Age, seniority and length of service are irrelevant to cyber criminals. Their aim is the path of least resistance, which normally means the first person in the firm who places trust where it is not warranted.
Phishing has become far more convincing than the badly written emails many people still picture. Messages are now well written, carefully timed and often personalised, which is why we described how the next generation of phishing attacks works and what to watch for.
Attackers also exploit everyday habits that people rarely question. A familiar-looking “prove you’re human” check, for example, can be used to trick someone into running harmful commands, a tactic we explored in the fake CAPTCHA trap.
Every one of these techniques relies on a person acting before they have thought it through. Technology can filter out a great deal, but it cannot catch everything, and the final decision often rests with whoever happens to receive the message.
Why the Stakes Are Higher in a Regulated Firm
For accountants, solicitors, financial advisers and brokers, a single mistake can have consequences well beyond the inconvenience of resetting a password.
- Client confidentiality: Professional firms hold highly sensitive personal and financial information. A compromised mailbox can expose years of client correspondence.
- Client money and payment fraud: Firms that handle payments or provide bank details are attractive targets for criminals who intercept emails and change account details at the critical moment.
- Regulatory expectations: UK GDPR requires organisations to take appropriate technical and organisational measures to protect personal data, and staff awareness is widely regarded as part of that. Professional regulators also expect firms to have sensible controls over the risks they face.
- Cyber insurance: Insurers increasingly want to understand how a firm manages cyber risk, and questions about staff awareness and training are common. Being able to show that training is regular and firm-wide puts you in a stronger position.
- Reputation and client confidence: Clients choose professional firms because they trust them. An incident that could have been prevented by better awareness is difficult to explain.
Criminals also impersonate the very platforms firms rely on. Fake security alerts that appear to come from Microsoft are a good example, and we explained why regulated firms must not let their guard down with fake Azure alerts.
Training Must Reflect How People Actually Work Today
Much of the cyber security training still in use was designed for a time when work happened mostly at a desk, on a firm-owned PC, inside the office. That is no longer how most professional firms operate.
A great deal of work now happens on mobile phones. Staff approve sign-in requests while travelling between client meetings. They open documents on personal devices, reply to emails in the few minutes between appointments and switch constantly between business and personal apps. Hybrid working means people may be at home, in a client’s office or on a train.
Each of these situations creates opportunities for error that office-based working did not. On a small screen it is harder to check a sender’s full address or hover over a link. A multi-factor authentication prompt that arrives mid-conversation can be accepted almost reflexively. A document shared to a personal device may sit outside the firm’s protections.
Good training recognises these realities. It uses examples that match the way your people work, so they can recognise risky situations before they become problems rather than learning about threats that feel remote from their day.
Building a Culture Where Checking Is Normal
The most valuable outcome of security awareness training is not a test score. It is a culture in which asking questions is completely normal.
If someone receives an unexpected email, an unusual request to change payment details or a login prompt they did not trigger, they should feel entirely comfortable stopping to check before they continue. That might mean phoning a client on a number already held on file, asking a colleague to take a second look or reporting the message to IT. None of these steps should feel awkward or be seen as a waste of time.
This depends heavily on leadership. When partners and directors take part in training themselves, report suspicious messages and acknowledge colleagues who raise concerns, the behaviour spreads throughout the firm. When someone reports a genuine mistake quickly, the response should be gratitude rather than blame, because early reporting is what limits the damage. A firm where people hide mistakes for fear of embarrassment is far more exposed than one where they speak up straight away.
What Effective Security Awareness Training Looks Like
There is no single programme that suits every firm, but effective training usually shares a few characteristics:
- It includes everyone: Partners, directors, fee earners, advisers, support staff and new starters all take part. No one is assumed to be exempt.
- It is short and regular: Brief, frequent sessions keep awareness fresh far better than a long annual course that is quickly forgotten.
- It is relevant: Scenarios reflect the firm’s real work, such as client document requests, payment instructions and Microsoft 365 sign-ins.
- It includes realistic practice: Simulated phishing exercises help people experience what a convincing attack looks like in a safe setting.
- It starts on day one: New starters receive security guidance as part of onboarding, before they build habits.
- It is measured: Tracking completion, simulation results and reporting rates shows where extra support is needed and gives you evidence for regulators and insurers.
Questions to Ask About Your Firm’s Current Approach
If you are unsure where your firm stands, these questions are a useful starting point for your next management meeting:
- When did every member of the firm, including partners and directors, last complete security awareness training?
- Does the training cover mobile working, sign-in approval requests and the use of personal devices?
- Do new starters receive guidance before they are given access to client data?
- Is there a simple, well-known way for staff to report a suspicious email or a mistake?
- Is there an agreed process for verifying any change to payment or bank details?
- Could you show a regulator or insurer evidence of the training your people have completed?
Bringing the Whole Firm With You
Cyber security is not a specialist subject reserved for the IT team or for the colleagues you think need the most help. It is a shared responsibility, and it works best when the whole firm learns together and moves in the same direction. The most digitally confident person in the office and the most experienced partner both benefit from understanding how attacks work today and from knowing that it is always acceptable to stop and check.
If your people have not had cyber security awareness training recently, or you are relying on people to work things out for themselves, Absolutely PC can help you put a practical, firm-wide programme in place.
What next?
One of my passions is helping businesses to succeed and if I can help you save some money as well – even better. You can fill out our contact form, phone us or click on the appointment button below and let’s start a conversation to see if I can help your business. Our guarantee:
- There are no hidden charges – this is a 100% free 15 minute consultation with no hidden charges.
- We will never spam you or sell on your contact details.
- We will treat your information with absolute confidentiality.
Other Posts for you to Enjoy
