It's easy to assume that younger employees are naturally better at using technology.
After all, they've grown up with smartphones, social media and apps. They've spent much of their lives online and can often find their way around new technology without a second thought.
So surely they're less likely to fall for a cyber attack?
Not necessarily.
There's a big difference between being comfortable with technology and knowing how to use it securely.
Someone might be brilliant at navigating apps, switching between devices and solving everyday technical problems.
But that doesn't automatically mean they'll recognise a convincing phishing email, spot a fake login page or understand the risks of reusing passwords.
And that's an important distinction for businesses to understand.
Cyber criminals don't care how old you are
One mistake businesses can make is assuming cyber security training is mainly needed by employees who aren't particularly confident with technology.
Younger or more technically capable members of the team might be expected to know what they're doing already.
But everyone has different gaps in their knowledge.
Someone might be excellent at spotting suspicious emails but use the same password across multiple accounts.
Another person might have strong password habits but approve an unexpected Microsoft 365 sign-in request without questioning it.
And even experienced employees can be caught out by a convincing message that appears to come from a colleague, customer or trusted supplier.
Cyber criminals aren't interested in how technically confident someone is.
They're looking for opportunities to trick people into giving away information, granting access or doing something they wouldn't normally do.
And anyone can make a mistake.
The way we work has changed
Cyber security awareness training also needs to reflect how people actually work today.
We're no longer sitting at the same desk, using the same computer, for eight hours a day.
Employees are checking emails on their phones, opening documents while travelling, approving sign-in requests between meetings and switching between business and personal applications.
And those everyday situations can create opportunities for attackers.
Imagine someone receives a Microsoft 365 authentication request while they're busy doing something else.
They've seen similar notifications hundreds of times before.
Without thinking, they approve it.
But what if they weren't the person trying to sign in?
Or perhaps an employee receives a convincing text message claiming to be from a delivery company, customer or colleague.
They might recognise the same message as suspicious on their work computer, but react differently when it arrives on their personal phone.
Being familiar with technology doesn't make someone immune to these situations.
That's why training needs to cover the threats people are actually encountering, across all the devices and applications they use.
Cyber security awareness should involve everyone
Good cyber security training isn't about making employees suspicious of everything.
It's about giving them the confidence to recognise when something doesn't look right and understand what to do next.
That includes knowing how to identify phishing attempts, question unexpected requests, protect passwords and recognise suspicious account activity.
But there's another important part.
People need to feel comfortable asking questions.
If an employee receives an unusual email or isn't sure whether a login request is genuine, they should feel able to check with someone before taking action.
And if they do make a mistake, they need to know how to report it quickly.
The sooner a potential security incident is reported, the sooner the business can investigate and respond.
Creating that kind of culture can be just as important as the training itself.
Don't assume your team already knows
Cyber security awareness isn't something employees automatically develop because they're young, technically confident or use technology every day.
It's something that needs to be taught, reinforced and kept up to date as threats change.
And it should involve everyone, from new starters to senior management.
Because even with strong technical security measures in place, employees will still encounter suspicious messages, unexpected requests and potentially convincing scams.
The aim is to help them make the right decisions when those situations arise.
Your business is better protected when everyone understands their role in keeping it secure.
If it's been a while since your team received cyber security awareness training, or you're relying on employees to recognise threats for themselves, we can help.
Get in touch to discuss how Cloud4 can help improve cyber security awareness across your business.