About This Course
Cyber threats are no longer the exclusive concern of IT departments — they affect every employee, every department, and every organisation regardless of size or sector. Human error remains the leading cause of security breaches worldwide, making staff awareness and behaviour change the most cost-effective investment an organisation can make in its cybersecurity strategy. This course was designed to bridge the gap between technical security controls and the people who interact with them every day.
The IT Security Awareness and Employee Training programme by TrainingComplex delivers practical, jargon-free security education tailored to a professional workforce. Participants will understand how attackers exploit human psychology, recognise the warning signs of phishing, ransomware, and social engineering, and adopt safe digital habits that protect both personal and organisational data. The course balances conceptual understanding with hands-on exercises drawn from real-world incident scenarios.
Beyond individual awareness, this programme builds a security-conscious culture by giving participants the language, confidence, and protocols to report suspicious activity, escalate incidents, and support organisational security policies. Whether your organisation is pursuing ISO 27001 compliance, GDPR alignment, or simply reducing its exposure to avoidable breaches, this training delivers measurable, lasting impact at every level of the workforce.
Who Should Attend
- All non-technical staff who use computers, email, or digital systems as part of their work
- Office administrators, executive assistants, and personal assistants
- Finance, HR, procurement, and operations professionals handling sensitive data
- Managers and team leaders responsible for enforcing security policies within their teams
- Customer service and frontline staff who interact with client data and external communications
- New employees being onboarded into organisations with formal security requirements
- Organisations seeking to meet compliance requirements such as ISO 27001, GDPR, or sector-specific data protection mandates
Learning Objectives
- Explain the current cyber threat landscape and understand why employees are the most targeted entry point for attackers
- Identify phishing emails, smishing messages, and social engineering tactics used by cybercriminals
- Apply safe password practices including the use of strong credentials, password managers, and multi-factor authentication
- Recognise and respond appropriately to ransomware, malware, and suspicious software behaviour
- Demonstrate safe internet browsing habits, including evaluating website security and avoiding risky downloads
- Protect sensitive data in accordance with organisational policies and applicable data protection regulations
- Understand the risks associated with removable media, personal devices, and remote working environments
- Report security incidents promptly and accurately using established escalation procedures
- Contribute to a security-aware workplace culture by modelling and promoting good digital hygiene
- Apply a practical incident response checklist to common workplace security scenarios
Course Modules
Module 1: Understanding the Cyber Threat Landscape
- The evolving nature of cybercrime and why it targets employees
- Types of cyber threats: phishing, malware, ransomware, insider threats, and more
- High-profile breach case studies and the human factors behind them
- Why every employee is a target regardless of seniority or technical role
- The financial, reputational, and operational costs of a successful cyberattack on an organisation
- How threat actors research and profile organisations and employees before launching attacks
Module 2: Social Engineering and Psychological Manipulation
- How attackers exploit trust, urgency, authority, and fear
- Common social engineering techniques: pretexting, baiting, quid pro quo, and tailgating
- Recognising manipulation in email, phone, and face-to-face interactions
- Practical exercises: spotting and shutting down social engineering attempts
- How open-source intelligence (OSINT) and social media exposure fuel targeted social engineering attacks
- Establishing a personal verification habit: safe ways to confirm identities and requests before acting
Module 3: Phishing, Smishing, and Vishing
- Anatomy of a phishing email: headers, sender addresses, links, and attachments
- Smishing (SMS phishing) and vishing (voice phishing) tactics and red flags
- Spear phishing and whaling: highly targeted attacks on individuals and executives
- What to do when you suspect a phishing attempt: reporting and not clicking
- How attackers use brand impersonation, lookalike domains, and urgency cues to increase click-through rates
- Business email compromise (BEC): how fraudsters hijack or spoof executive accounts to authorise fraudulent transactions
Module 4: Password Security and Authentication Best Practices
- Why weak passwords are an organisation's most exploited vulnerability
- Creating and managing strong, unique passwords for every account
- Introduction to password managers: setup, use, and organisational policy alignment
- Multi-factor authentication (MFA): what it is, why it matters, and how to use it
- How credential stuffing and brute-force attacks work and why password reuse is so dangerous
- Recognising and responding to account takeover warning signs: unexpected login alerts, locked accounts, and unauthorised changes
Module 5: Safe Internet Browsing and Email Practices
- Reading URLs and identifying secure versus fraudulent websites (HTTPS, domain spoofing)
- Risks of public Wi-Fi and how to browse safely on unsecured networks
- Email etiquette that reduces risk: avoiding forwarding sensitive data, verifying requests
- Safe use of cloud-based tools, file sharing platforms, and browser extensions
- Understanding browser security settings, cookie policies, and the risks of saving credentials in browsers
- How to evaluate and vet third-party software, plug-ins, and online tools before use on company devices
Module 6: Malware, Ransomware, and Endpoint Security
- How malware and ransomware infect systems and spread across networks
- Recognising the early signs of a compromised device or suspicious system behaviour
- The role of antivirus software, system updates, and patch management
- What to do — and not to do — if you suspect your device has been infected
- How removable media such as USB drives can introduce malware and the policies governing their use
- Understanding the ransomware payment dilemma: why paying a ransom rarely resolves the threat and what organisations do instead
Module 7: Data Protection and Information Handling
- Understanding personal data, sensitive data, and organisational confidential information
- Key principles of data protection legislation (GDPR, Kenya Data Protection Act)
- Safe handling, storage, sharing, and disposal of sensitive information
- Risks of shadow IT, personal email use, and unauthorised data sharing
- Data classification frameworks: how to identify the sensitivity level of information and apply appropriate controls
- Employee rights, responsibilities, and consequences under data protection law: understanding your personal accountability
Module 8: Remote Working and Mobile Device Security
- Security risks unique to remote and hybrid working environments
- Secure home network setup and the use of VPNs for remote access
- Mobile device management: BYOD policies, screen locks, and app permissions
- Physical security considerations: shoulder surfing, clear-desk policies, and travel security
- Recognising and responding to security incidents when working outside the corporate network without immediate IT support
- Secure video conferencing practices: managing screen sharing, participant access, and sensitive discussions in virtual meetings
Module 9: Incident Recognition, Reporting, and Response
- Defining a security incident versus a minor IT issue
- Organisational incident reporting procedures and escalation pathways
- What information to capture and preserve when an incident occurs
- Group exercise: walking through an incident response checklist in a simulated scenario
- The importance of timely reporting: how delays in flagging incidents increase organisational damage and regulatory liability
- Post-incident review: understanding lessons-learned processes and how employee feedback shapes improved security controls
Module 10: Building a Security-Aware Workplace Culture
- The role of individual behaviour in organisational cyber resilience
- How to raise security concerns without fear and promote peer accountability
- Security awareness as an ongoing practice: staying current with emerging threats
- Personal action planning: committing to specific security habits and supporting colleagues
- How leadership behaviour and visible commitment from management shape the security culture of an entire organisation
- Measuring security culture: understanding how organisations assess awareness maturity and what meaningful improvement looks like
Requirements & Prerequisites
No technical background or IT experience is required to attend this course. Participants should be comfortable using a computer, email, and the internet as part of their daily work. A willingness to engage in group discussions, role plays, and hands-on exercises is all that is needed to benefit fully from this programme.
Training Methodology
- Simulated phishing exercises using realistic email samples drawn from actual attack campaigns, followed by guided debrief discussions
- Case study analysis of high-profile data breaches including causes, human factors, and lessons learned applicable to participants' own organisations
- Role-play scenarios in which participants practise recognising and responding to social engineering attempts over phone, email, and in person
- Hands-on password strength assessments and live demonstrations of password manager tools and multi-factor authentication setup
- Group workshops using incident reporting templates and escalation checklists to practise real-world response procedures
- Interactive quizzes and scenario-based knowledge checks at the close of each module to reinforce key concepts
- Small-group reflection exercises linking course content to participants' own workplace systems, data handling practices, and security policies
- Peer-learning discussions facilitated by the trainer to surface organisation-specific risks and collectively develop practical mitigation habits
Organisational Benefits
- Significant reduction in successful phishing attacks and human-error-driven security breaches
- Improved compliance with data protection regulations such as GDPR, Kenya's Data Protection Act, and sector-specific mandates
- A measurably stronger security culture in which employees proactively report suspicious activity
- Reduced financial and reputational damage associated with ransomware, data leaks, and fraud
- Stronger alignment between IT security policies and actual employee behaviour across departments
- Support for ISO 27001 certification and other information security management frameworks
- More confident, security-conscious employees who require less reactive IT support for avoidable incidents
- Reduced liability exposure by demonstrating due diligence in staff security education
Where Is IT Security Awareness and Employee Training Offered?
This course runs in-person across: Mombasa, Lagos, Kampala, Dar es Salaam, Accra, Naivasha, Kigali, Riyadh, Cape Town, Addis Ababa, Nakuru, Pretoria, Kisumu, Johannesburg, Arusha, Nairobi, Dubai, Abuja, Zanzibar, plus Live Virtual (online) cohorts. Browse live dates for your city below.
Upcoming Schedules
| Location | Format | Dates | Price |
|---|
| Mombasa, Kenya |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
KES 120,000 |
| Lagos, Nigeria |
In-Person |
5 Oct 2026 – 9 Oct 2026 |
USD 2,500 |
| Kampala, Uganda |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 1,900 |
| Dar es Salaam, Tanzania |
In-Person |
12 Oct 2026 – 16 Oct 2026 |
USD 2,300 |
| Accra, Ghana |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,800 |
| Naivasha, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 120,000 |
| Kigali, Rwanda |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 1,900 |
| Riyadh, Saudi Arabia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 4,500 |
| Cape Town, South Africa |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 3,800 |
| Addis Ababa, Ethiopia |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
USD 2,400 |
| Nakuru, Kenya |
In-Person |
19 Oct 2026 – 23 Oct 2026 |
KES 120,000 |
| Live Virtual |
Online |
26 Oct 2026 – 30 Oct 2026 |
KES 80,000 |
| Pretoria, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,300 |
| Kisumu, Kenya |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
KES 120,000 |
| Johannesburg, South Africa |
In-Person |
26 Oct 2026 – 30 Oct 2026 |
USD 3,500 |
+232 more dates — view live schedule →
Frequently Asked Questions
Do I need a technical background to attend this course?
No technical experience is required whatsoever. This course is designed specifically for non-technical staff and professionals who use digital tools as part of their everyday work. All concepts are explained in plain language with practical, workplace-relevant examples.
Will I receive a certificate upon completion?
Yes. Participants who attend and complete the full five-day programme will receive a TrainingComplex Certificate of Completion in IT Security Awareness and Employee Training. This certificate is a useful record for personal development portfolios and organisational compliance documentation.
Can this course be delivered as in-house training for an entire organisation?
Absolutely. TrainingComplex offers this programme as a dedicated in-house engagement for organisations wishing to train large teams simultaneously. Content can be tailored to reflect your specific industry, internal policies, and existing IT systems for maximum relevance.
How is the course assessed?
Assessment is ongoing and practical rather than exam-based. Participants take part in scenario exercises, simulated phishing drills, and group discussions that consolidate learning throughout the week. There is no written examination, making this course accessible and engaging for all learning styles.
Is this course relevant for managers and team leaders, or only frontline staff?
It is highly relevant for both. Managers and team leaders have an added responsibility to model good security behaviour and enforce policies within their teams, and this course addresses that leadership dimension directly. Organisations often find it most effective to train managers and staff together to build a unified security culture.
