Cybersecurity for HR teams

Who it is for

Objectives

Sessions and topics

6 sessions × 90 minutes · 9 hours · The final assessment takes place separately from the live sessions.

1. Session 1

   • Why people are targeted — See why attackers target the people who handle money, information and decisions. Learn when to pause and check a request before it causes a loss.
   • Cyber threats and business impact — Understand cyber threats through their business impact: lost money, stolen information and interrupted work. Connect risk to everyday decisions, whatever your organisation’s size.
   • Everyday security habits — Spot the everyday shortcuts that leave information and access exposed. Build practical habits for your screen, files and workspace.

2. Session 2

   • Social engineering — Recognise requests that use fear, authority or helpfulness to rush a decision. Practise checking through a trusted contact, even when the story sounds convincing.
   • Phishing in email and messages — Check the request, sender and destination before opening a link or attachment. Apply the same judgement to email, text messages and WhatsApp.
   • Scam calls and QR-code traps — Recognise phone calls and QR codes that steer you towards a fraudulent request. Learn to verify the caller or destination independently and keep authentication codes private.
   • AI impersonation and deepfakes — A familiar voice or convincing video can still carry a fraudulent request. Practise checks that work even when an AI-generated impersonation has no obvious flaws.

3. Session 3

   • Passwords and accounts — Use distinct passwords and keep work access separate from personal accounts. Recognise requests to share a password and know what to do if it has been exposed.
   • Multi-factor authentication — Understand how an unexpected sign-in approval can become a trap. Learn to question prompts you did not initiate and keep access codes to yourself.
   • Safer email and web browsing — Spot risks in suggested recipients, reply-all messages and misleading web pages. Check where information is going before you send it or continue browsing.
   • Apps, downloads and USB devices — Recognise apps, downloads and USB devices that ask for trust too quickly. Choose approved tools and seek help before trying an improvised workaround.

4. Session 4

   • Malware and ransomware: first steps — Recognise warning signs that malicious software may be affecting your files or device. Learn the first actions that limit the problem while specialist help takes over.
   • Using AI safely at work — Understand what information belongs in an approved AI tool and what must stay protected. Check its output before using it in a document or decision.
   • Sharing information with the right people — Match the information, recipient and sharing method to the business need. Recognise requests that grant wider access or disclose more information than necessary.
   • Recognising and reporting concerns — Know what to report and how to help your organisation respond quickly, including after your own mistake. Share useful facts without spreading the exposure.

5. Session 5

   • Payroll fraud — Spot false requests to change salary bank details or release payslips. Confirm the person and the instruction before changing or sharing payroll information.
   • Safer recruitment — Recognise CVs and portfolios that demand unusual software or access. Keep recruitment moving through approved tools and channels.

6. Session 6

   • Protecting personnel files — Recognise excessive requests for employee records. Keep and share only the documents needed, with the people authorised to receive them.
   • Personal data and GDPR at work — Recognise data requests that invoke a genuine right for an unverified purpose. Apply the General Data Protection Regulation (GDPR) to everyday decisions about identity, purpose and necessary information.
   • Joining and leaving the organisation — Recognise rushed requests that leave access active or give it to an unverified person. Know what to communicate and confirm when someone joins or leaves.

Delivery format

Instructor

Duration and scheduling

Materials and resources included