New starters are at their most phishable in their first weeks - no baseline for what normal looks like, no idea who legitimately asks for credentials or payments, and a queue of welcome emails that train them to click. A cyber security induction closes that window: what to cover on day one, week one and month one, in a checklist you can run for every new employee in 2026.
TL;DR
- The first weeks are the highest-risk window: new staff have no baseline for normal and attackers exploit onboarding inbox noise.
- Day one: accounts with MFA, the report button demo, and who to call when something feels off.
- Week one: first short training module and policy acknowledgements.
- Month one: first phishing simulation with coaching, not blame.
- Auto-enrolment from your HR or directory system makes the checklist run itself for every new hire.
Why new starters are the highest-risk window
Attackers know onboarding is noisy. A new starter's inbox fills with welcome messages, setup instructions and document requests in their first days, which is exactly the environment a phishing email blends into. Meanwhile the new starter has no baseline: they have never seen what a real invoice looks like here, they do not know the finance team's voice on the phone, and they are eager to prove responsiveness. The combination is why onboarding-themed phishing works so well.
Day one checklist
- Accounts issued with MFA enabled before first login - no starter account exists without it.
- Report button demonstrated: show where the phishing report button lives in Outlook or Gmail and what happens when it is used.
- Escalation path named: the exact person or channel to contact when something feels wrong, and the promise that fast reporting is always the right call.
- Personal device boundaries stated: what may and may not be done on work accounts from personal phones or laptops.
- Password manager installed and first credentials stored in it, not in a browser or notebook.
Week one checklist
- First training module completed - a 5-minute phishing and social engineering lesson, not a 45-minute course nobody finishes.
- Policy acknowledgements signed - acceptable use, remote work and data handling, with a filed acknowledgement.
- Baseline risk factors captured for role-based training paths: finance access, customer data, privileged systems.
- Manager briefed on the starter's role in the reporting culture: praise every report, including false alarms.
Month one checklist
- First phishing simulation delivered with instant coaching for anyone who clicks - the point is the teachable moment, not the score.
- Module two delivered matched to role: payment fraud for finance, records handling for clinical or client-facing staff.
- Completion recorded in the training system, so the audit trail starts with the first month of employment.
- Onboarding-themed simulation considered for the wider team: fake welcome-pack and IT-setup lures teach the whole organisation what real onboarding phishing looks like.
Making it run itself
Running this checklist manually per hire is the reason most small businesses skip it. Auto-enrolment from Microsoft 365 or Google Workspace keeps the learner list in sync automatically - new starters appear, and baseline training is assigned the moment their account exists, with reminders chasing completion. The auto-enrolment page covers the integrations, security awareness training the module cadence, and human risk reporting the per-team completion view a manager actually opens.
FAQ
Why are new employees more vulnerable to phishing? They have no baseline for what normal looks like at your company, their inbox is full of genuine welcome and setup emails that phishing blends into, and they are motivated to respond quickly to authority - the exact conditions social engineering exploits.
What should be in a cyber security induction? At minimum: MFA on all accounts before first login, a demonstration of the phishing report button, a named escalation path, the first short training module, and signed policy acknowledgements - all in the first week.
How long should cyber security induction take? About 15 minutes of staff time in week one, plus a 5-minute monthly module afterwards. Anything longer does not get finished and produces no evidence trail.
When should a new starter do their first phishing simulation? Within the first month, with instant coaching for anyone who clicks. The goal is a safe teachable moment early, while habits are still forming.
Can onboarding be automated? Yes - auto-enrolment from Microsoft 365 or Google Workspace picks up each new starter automatically, sends the first module and reminders, and records completion without manual admin.