A security awareness program for 100 employees should help people make safer decisions during ordinary work, not simply complete an annual course. Start with a few risks tied to the company’s processes, teach a shared baseline plus role-specific actions, and make reporting concerns easy. Then practice, measure what happens, and fix the barriers employees encounter.
Call (617) 778-4584 to discuss your security priorities Schedule a conversation about your security priorities
What should a 100-person program accomplish?
The aim is not to turn every employee into a security specialist. The aim is to make expected actions obvious: protect access, verify unusual requests, handle information through approved channels, and report uncertainty quickly. Every employee should be able to answer three questions:
What information, systems, or decisions do I need to protect in my role?
What should I do when a message, request, login prompt, or device seems unusual?
Where do I report it, and what happens after I do?
For an organization of 100 people, clarity and consistency matter more than an extensive course library. Employees need realistic examples and a response process that does not punish them for raising a concern. Leaders need enough visibility to identify patterns, decide what to improve, and assign an owner.
Keep the program distinct from a general security policy. A policy states expectations; the awareness program turns them into usable actions, practice, and feedback. It also connects with incident response and risk ownership. A company reviewing its broader cybersecurity risk assessment process can use the same business risks to decide which employee behaviors deserve attention first.
How should leaders set the program scope?
Begin with a short working session involving an executive sponsor, IT or security, HR, and owners of important business processes. Do not start by selecting a training vendor. First identify how the organization uses email and collaboration tools, handles customer and employee information, grants remote access, processes payments, and depends on vendors. Ask about incidents, near misses, recurring questions, and process changes without assuming that one threat is the only concern.
Turn the discussion into a manageable list of priority behaviors. Examples might include verifying a bank-detail change through a known phone number, using an approved method to share a sensitive file, reporting an unexpected multi-factor authentication prompt, and checking with IT before installing unfamiliar software. A behavior should be specific enough that an employee can tell what to do next. “Be careful online” is not a usable instruction; “stop and call the known vendor contact before changing payment details” is.
Write a one-page charter before launching. It should name the sponsor, program owner, participating groups, reporting route, exercise boundaries, and review cadence. If internal IT and a managed service provider share support, make the handoff explicit: who receives the initial report, who investigates, and who tells leadership about a material issue? Security leadership can help connect awareness to policy and response responsibilities; see the outline of fractional CISO services for the broader governance context.
Which employee roles need different guidance?
Give everyone a common foundation, then adapt examples to work decisions and access rather than relying only on job titles. A 100-person company often does not need dozens of separate tracks. A few practical groups may cover the main differences:
All employees: recognize suspicious messages and unexpected prompts, protect credentials, use approved sharing practices, and report concerns.
Finance and executives: independently verify unusual payment instructions, changes to supplier details, and urgent requests for confidential information. Do not rely only on the reply path in the requesting message.
People operations: handle personnel records carefully and verify requests for sensitive employee information through established channels.
IT administrators: follow safeguards for privileged access, preserve relevant details during a suspected incident, and understand escalation and communications responsibilities.
Customer-facing and operations teams: route unusual requests or service interruptions to the right owner instead of improvising a workaround that bypasses controls.
Managers: reinforce the reporting route, help employees pause under pressure, and escalate recurring workflow problems.
Use scenarios that feel familiar. A finance employee might work through a supplier bank-change request. A new employee could practice reporting a sign-in prompt they did not initiate. An operations employee might receive an unexpected request to use a personal file-sharing account because a usual system is unavailable. The lesson is not to memorize a script for one example. It is to notice the pressure or exception, verify through a trusted route, and ask for help.
Keep the baseline in each role track. A specialist group may need extra practice, but all employees should know that a suspicious event belongs in the same reporting process. Role-specific material should make the common rule more relevant, not create conflicting instructions.
How should the program adapt as a company grows?
The phrase “100 employees” is a useful planning point, not a fixed design rule. A company of 50 people may have a small number of managers wearing several hats, while a 500-person organization may have more sites, shifts, vendors, and distinct data responsibilities. Scale the coordination and role coverage to the work. Do not assume that every employee needs a separate course or that a smaller organization can skip ownership and response planning.
At the smaller end, a named owner can coordinate with HR and IT and use a short, shared baseline plus a handful of role-specific examples. Make sure reporting still has backup coverage when the owner is away. As the organization grows, assign department contacts, track which groups have received guidance, and standardize the way managers reinforce it. The goal is consistent expectations, not more process for its own sake. The program owner should coordinate priorities, keep guidance current, and ensure that reports reach the right response team; this is one part of the wider leadership role described in the overview of what a fractional CISO does.
Leaders should connect the program to the company's wider security responsibilities. The fractional CISO guide for mid-market leaders discusses executive security leadership in a broader context. Where board or executive oversight is relevant, the technology risk reporting guide can help frame how leaders receive risk information. Keep the awareness plan itself practical: identify the right audience, the behavior expected, the owner who supports it, and how the organization will learn whether the process works.
How should training and practice work together?
Use brief, recurring learning instead of relying on one long annual session. A practical rhythm might include orientation for new hires, short refreshers during the year, and targeted guidance after a meaningful change or incident. Set the cadence according to risk, workforce capacity, and applicable obligations; a calendar alone does not prove that employees can use what they learned.
Pair each lesson with a behavior to practice. For example, after explaining how to check a suspicious message, show how to submit it through the company’s real reporting channel. After reviewing payment verification, let finance staff rehearse the second-channel check using a fictional request. Ask employees to identify what makes the situation unusual, which action comes first, and where they would go if the usual contact is unavailable.
Phishing exercises can test whether employees recognize and report a simulated message, but they should be realistic, respectful, and designed to teach. Set clear boundaries, avoid collecting unnecessary personal information, and do not use public shaming. If an employee interacts with a simulation, follow up privately and promptly with the relevant clues and the correct reporting step. Treat results as information about both employee understanding and the design of the exercise.
There is no single delivery model that fits every organization. A generic course library can be convenient to administer, but it may not reflect local workflows. Short role-based learning takes more preparation, but can connect guidance to real decisions. Exercises and manager coaching allow practice, but require the support team to be ready for questions and reports. A useful combination is a shared baseline, a small number of role-specific scenarios, and periodic practice on the reporting process.
For general employee guidance, the Cybersecurity and Infrastructure Security Agency (CISA) is a U.S. government source. Use external guidance as a reference, then check that company-specific instructions match the tools and support routes employees actually have.
How can employees report concerns quickly?
Make reporting easier than trying to decide whether something is definitely dangerous. Choose one obvious route employees already know how to use, such as a designated mailbox, a reporting button, or a help-desk process. State what information is useful: what appeared, when it appeared, whether the person clicked or replied, and whether they entered credentials, approved a prompt, or shared information.
Tell people what to do after a possible mistake. They should contact the designated support channel promptly, explain what happened, and follow instructions. They should not hide the event or delete relevant messages while trying to clean up on their own. The response team should acknowledge reports, triage them, and explain next steps where appropriate. A fast, calm response makes it more likely that people will report the next concern too.
Test the route before the program goes live. Submit a test report and confirm that it reaches an owner, receives a response, and can be escalated when needed. Check coverage outside business hours if the organization expects people to report then. Record the primary owner, backup, urgency path, and leadership escalation. A reporting button nobody monitors can create false confidence even if the training itself is clear.
Connect employee guidance to the company’s incident process. People do not need to make technical judgments, but they should know when to stop an action, contact support, and preserve relevant details. Leaders planning for executive-level threats can also consider the themes in this guide to cybersecurity threats facing business leaders, while keeping the employee reporting instructions short and specific.
What should leaders measure?
Choose a small set of measures that show whether employees can act and whether the organization responds. Avoid collecting numbers just because a platform offers them. For a starting point, track:
Participation: completion and participation by role, including groups that have not received the planned learning.
Reporting: volume of reports, time between an event and its report when that information is available, and whether people use the intended route.
Response: acknowledgement and triage time, missed handoffs, and completion of follow-up actions.
Practice: patterns in consistent exercises, such as whether employees report a simulated message, interpreted alongside the exercise design and context.
Learning: questions employees ask, recurring points of confusion, and whether relevant teams can explain the action expected in a scenario.
A single click rate is not a complete measure of security culture. More reports can indicate greater willingness to speak up, not a worsening program. A low rate might reflect effective learning, an unrealistic exercise, or a reporting route employees cannot find. Interpret indicators together and look for patterns across time and roles rather than treating one exercise as a verdict on an individual.
Review findings with leadership in plain language: what behavior appears to be working, where employees are uncertain, what operational exposure that creates, and who will take the next step. For example, if employees repeatedly report unexpected login prompts but are unsure whether to approve or deny them, clarify the instruction and verify that the support route is visible. If a particular team cannot verify supplier changes because contact details are hard to find, fix the process as well as the lesson.
A compact scorecard can include the measure, what it can and cannot show, the owner, and the next action. Keep it focused enough to review regularly. Leaders should also record decisions and revisit priorities when the organization changes systems, vendors, processes, or roles.
How can managers and executives reinforce secure habits?
Managers shape whether employees pause and report or quietly work around a control. Give managers a short discussion guide instead of asking them to become security instructors. Useful questions include: “What would make this request unusual?”, “How would you verify it?”, and “Where would you report it?” Managers should praise early reporting, route policy questions to the right owner, and raise recurring obstacles rather than inventing exceptions.
Executives should follow the same expectations. When leaders verify sensitive requests, use approved sharing channels, and report mistakes, they show that the process applies across the organization. The sponsor should also give the program owner time to communicate results and resolve barriers between departments. Awareness cannot compensate for leaders who reward speed at any cost or treat a reported mistake as a reason to blame the person who raised it.
Make reinforcement part of existing routines. A manager can spend a few minutes in a team meeting discussing one realistic scenario, then remind employees of the reporting route. HR can include the same contact information in onboarding and role changes. IT can update instructions when tools change and share short, factual notices after a recurring pattern appears. Repetition is useful when each reminder includes a clear action, not just another warning.
What does a practical launch sequence look like?
Weeks 1–2: establish ownership. Confirm the executive sponsor, program owner, participating teams, reporting route, support coverage, and business processes in scope. Test the reporting channel and document who receives and escalates concerns.
Weeks 3–4: set a baseline. Review policies, past concerns, system changes, and role groups. Select a short list of priority behaviors and decide what evidence would indicate that employees understand them.
Month 2: launch shared guidance. Give employees concise baseline learning and role-relevant examples. Explain how to report and what the support team will do after receiving a report.
Month 3: practice on a limited scale. Run an exercise with a defined audience or scenario. Review questions, reports, response timing, and any confusion. Fix unclear instructions before expanding the exercise.
Ongoing: reinforce and improve. Use brief refreshers, manager prompts, and periodic reviews. Assign owners to changes and check whether those actions were completed.
This sequence is a planning aid, not a fixed compliance timetable. If the organization has regulatory or contractual obligations, map its learning and evidence to the applicable requirements with qualified guidance. For companies aligning leadership roles, risk decisions, and accountability, the IT governance framework guide offers related context, while the awareness plan itself should remain focused on employee actions and response readiness.
What mistakes make awareness programs less effective?
Training without a reporting route: employees may recognize a concern but have no clear next step.
Using shame as motivation: fear of embarrassment or punishment can discourage useful reports.
Measuring only completion: finishing a lesson does not show that the instructions work in a real situation.
Using generic reminders: broad warnings become background noise if they do not tell people what action to take.
Ignoring operational obstacles: employees cannot follow a process that conflicts with their tools, workload, or approved workflow.
Running exercises without support: a test can raise questions and reports that nobody is ready to handle.
Leaving ownership unclear: concerns can languish when no one owns triage, escalation, and follow-up.
Expecting awareness to replace controls: employee guidance complements technical safeguards, clear policies, and response planning; it does not substitute for them.
When a pattern recurs, investigate the system around the behavior. If staff repeatedly bypass a file-sharing rule, ask whether the approved option is accessible and suitable for their work. If reports arrive late, determine whether people know the channel and whether it is available when they need it. Improve the process alongside the training rather than repeating the same reminder without learning why the problem persists.
Frequently Asked Questions
How often should a 100-person company provide security awareness training?
Use onboarding, recurring short learning, and practice at a cadence that reflects risk, workforce capacity, and applicable obligations. Reinforce guidance after relevant process or system changes. A calendar of completed courses is useful for administration, but it should be paired with evidence about reporting and follow-through.
Should every employee receive the same training?
Give everyone a shared baseline, then add scenarios for roles that handle different information, systems, or decisions. Keep the reporting route and core expectations consistent so a specialist track does not create conflicting instructions.
Is phishing simulation enough to build awareness?
No. A simulation can give people practice recognizing and reporting a suspicious message, but employees also need guidance on verifying unusual requests, protecting information, and responding to unexpected prompts. The organization must also acknowledge and act on reports.
What should we do first if we have no program?
Name an executive sponsor and program owner, establish and test one reporting route, and identify a few priority behaviors tied to the company’s work. Then give employees concise instructions, practice a realistic scenario, and use their questions and operational feedback to improve the program.
Explore cybersecurity leadership support Call (617) 778-4584 to discuss cybersecurity leadership
A durable awareness program combines clear ownership, relevant habits, safe reporting, realistic practice, and regular improvement. Start with actions employees can use today, then let experience show the organization what to strengthen next.
