Security Awareness Annual Refresher 2026 Training

Opens by asking when you last stopped to check a message, then gives two reasons to refresh each year: habits fade and threats change. Notes that PCI DSS asks for awareness training at hire and at least every twelve months, and that ISO 27001 expects awareness training and regular updates. Walks through the FBI report published in April 2026: more than 1,008,000 complaints in 2025, losses above twenty billion US dollars, and phishing and spoofing as the crime reported most often. Adds ENISA's October 2025 finding that phishing was the way in for about 60% of incidents where entry was visible. Explains the FBI's December 2024 warning on AI-written scams and cloned voices, and why poor spelling is no longer a warning sign. Introduces HJK Logistics LLC, a worked example of a freight company in Dubai, and the stop, check, report habit.

What you will be able to do

• Explain why awareness training is refreshed every year as habits fade and threats change
• Recognise why clean spelling and the right logo no longer prove a message is genuine
• Apply the stop, check through a known channel, and report habit to any urgent request

Why it matters

Gives staff a current reason to slow down before acting on a message, and helps meet the yearly awareness training PCI DSS and ISO 27001 expect.

Practice: Practice: This year in security · 3 questions

Follows one Monday at HJK Logistics in Dubai: a QR code e-mail from the IT Service Desk, a text about a held shipment and a customs fee, and a voice note that sounds like the chief executive. Refreshes the four signs of phishing: pressure, authority, a request and something slightly wrong, noting that bad spelling is missing from the list. Explains smishing and vishing through the FBI's May 2025 warning about texts and AI voice messages posing as senior US officials. Covers quishing from the FBI's January 2026 alert, where QR codes lead to fake Microsoft 365, Okta or VPN sign-in pages on a phone, beyond the work computer's protection. Gives the stop, check, go direct and report steps, what to do if you already scanned a code, and closes with an exercise on the agent's e-mail and advice for finance, managers and IT.

What you will be able to do

• Identify the four signs of phishing across e-mail, text, voice messages and QR codes
• Explain why a QR code in an e-mail bypasses the protection on a work computer
• Report a scanned code or typed password at once with the facts IT needs

Why it matters

Helps staff spot phishing on every channel, including QR codes and cloned voices, so one early report protects every colleague who got the message.

Practice: Practice: Phishing in all its forms · 3 questions

Starts with a Thursday afternoon in the HJK Logistics finance team: a carrier's e-mail announcing new bank details, then a video call with what looks like the chief financial officer asking for a quiet, same-day payment. Defines business e-mail compromise and gives the FBI's 2025 figures: 24,768 complaints, reported losses of more than three billion US dollars, and more than thirty million lost to fraud involving AI. Explains why a taken-over supplier mailbox shows nothing wrong. Describes the February 2024 Arup case in Hong Kong, where an employee made fifteen transfers totalling two hundred million Hong Kong dollars after a call with digital imitations of colleagues. Sets out the call-back rule, the second approval and the warning words urgent and secret, then the exercise, payment recall and the FBI recovery team's 58% success rate, and family distress scams with a secret word.

What you will be able to do

• Explain how business e-mail compromise uses fake suppliers, fake bosses and AI-made voices or faces
• Apply the call-back rule on a number already held before any bank-detail change or payment
• Act at once to recall a payment through the bank if money has already gone

Why it matters

Gives finance teams and managers a simple control that stops fraudulent transfers and improves the chance of recovering money that has already left.

Practice: Practice: Payment fraud and deepfakes · 3 questions

Follows a dispatcher at HJK Logistics in Riyadh who receives five sign-in prompts in three minutes at night, then a morning call from someone posing as the IT help desk asking for his code. Explains the July 2025 joint advisory from the FBI, CISA and partner agencies on Scattered Spider, its MFA fatigue method and help desk calls in both directions. Gives the rule: never approve a sign-in you did not start, never share a code, and report at once, plus what to do if you already approved. Links back to QR codes and how fake pages capture signed-in sessions. Covers the UK National Cyber Security Centre's April 2026 advice that passkeys should be the first choice, then password basics: long, unique, managed, with the second step on. Ends with the dispatcher exercise and steps for help desk, IT and managers.

What you will be able to do

• Recognise MFA fatigue and deny any sign-in prompt you did not start
• Distinguish fake help desk calls made to staff from calls made to the help desk
• Explain why passkeys resist phishing better than passwords and one-time codes

Why it matters

Protects accounts against prompt floods, help desk impersonation and session theft, so a leaked password becomes a near miss instead of a breach.

Practice: Practice: Sign-ins and accounts · 3 questions

Opens with one week at HJK Logistics in Abu Dhabi: a shipping file sent to the wrong customer, a QR code on a staff discount flyer, and a sign-in prompt denied at night, and shows all three should be reported. Lists what counts, from suspicious messages and scanned codes to wrong-place information, lost devices and near misses. Sets out how to report: stop without playing detective, keep the evidence, report through your organisation's channel and follow the instructions. Compares a vague late report with one giving four facts: what happened, when, what you have done since and what may be at risk. Explains why speed matters, how fear and doubt stop people reporting, and the denied prompt exercise. Adds rules for approved AI tools and keeping client data out of public AI chats. Closes with five commitments and the final exam.

What you will be able to do

• Identify which events, slips and near misses should be reported as security incidents
• Write an incident report giving what happened, when, what you did and what is at risk
• Use only approved AI tools and keep personal and client data out of public chats

Why it matters

Builds a reporting habit that lets IT act within minutes, not days, and leaves each learner with five clear security commitments for the year.

Practice: Practice: Reporting and your year ahead · 3 questions