A new starter's first weeks are the most dangerous window in your security programme: they have no office norms to fall back on, they do not yet know who to call when something looks wrong, and scammers know it — impersonating a manager or the IT provider to a new employee works precisely because the new employee has never met either. This checklist covers what to cover in week one, what to defer to month one, and what to automate so it happens every time.
Week one checklist
| # | Item | Why it matters | Owner |
|---|---|---|---|
| 1 | Enrol in security awareness training | The habits formed before the first real phishing email arrives are the ones that hold | Manager or auto-enrolment |
| 2 | Baseline phishing simulation in the first fortnight | A safe measurement of the starting point, before inbox trust is formed | IT or training admin |
| 3 | Show the report-phishing button and how it works | The reporting reflex is the single behaviour that closes incidents fastest | Manager, in person or on a call |
| 4 | MFA on every account, and the rule: never approve a prompt you did not trigger | Stops the account-takeover chain most incidents run through | IT |
| 5 | Password manager set up; no reused personal passwords | Credential reuse is how one breached personal account becomes a work incident | IT |
| 6 | Device check: encryption on, patching on, screen lock, endpoint protection | The device is the new office perimeter for remote and hybrid staff | IT |
| 7 | Escalation card: who to contact, at any hour, if something feels wrong | Removes the hesitation that turns a small incident into a big one | Manager |
| 8 | Data-handling basics: where customer data lives, what is allowed where | Prevents the well-meaning workaround (email to personal account) that creates breaches | Manager |
Items 1-4 are the core; the rest should land within the first month.
What to defer to month one
- Deeper phishing theory. Sender-policy frameworks, header analysis and lookalike-domain patterns are for the curious, not the first week.
- Framework and compliance context. Essential Eight, SMB1001 or ISO 27001 context matters for some roles, not all — cover it once the basics are embedded.
- Role-specific modules. Finance staff get payment-verification drills; admins get document-handling rules; developers get secret-management basics. Assign these in week two or three, once the general habits are in place.
- Social engineering deep-dives. Phone-based pretexting and deepfake-voice scams are real, but they are a month-two topic — the reflexes have to come first.
The habits that matter most
Three behaviours predict most of the outcome:
- Reporting before deleting. A suspicious email reported in minutes lets IT remove it from every mailbox before anyone else opens it. Every real report is also practice for the reflex.
- Callback verification. Any change to payment details or an urgent request for credentials is confirmed by phone on a number you already hold — never by reply email and never on the number in the message.
- MFA discipline. A stolen password is worthless if the second factor holds; approving an unexpected prompt is how it fails anyway.
Training exists to build these three habits; everything else is supporting detail.
What to automate
- Enrolment. New starters auto-enrolled the day they start, not when someone remembers — platforms like Cyber Aware sync new hires from your HR system automatically.
- Reminders and grace periods. Escalating reminders after a module's due date, with a grace period so a bad week does not become a disciplinary matter.
- Auto-remediation on simulation clicks. A short coaching module delivered within the hour of a click, while the lesson is fresh.
- Monthly reporting. Human risk reporting rolls completion and simulation data into a per-person risk score, so the manager's question ("who needs a conversation?") is answered by data rather than memory.
Common mistakes
- Saving security induction for "once they've settled in" — the risk window is the first fortnight, not the first quarter.
- Sending a stack of PDF policies and calling it training.
- No escalation contact, so a suspicious email sits in an inbox all weekend.
- Never running a baseline simulation, so nobody knows what the starting point was.
- Treating onboarding as one-and-done — the ongoing programme is what makes the habits stick.
FAQ
When should cyber security onboarding happen? In the first week, with the core items (training enrolment, report button, MFA discipline) on day one or two. The first fortnight is the highest-risk window.
What single item matters most? Showing the report-phishing button and normalising its use. A new starter who reports a suspicious email in their first month has just closed the most common incident path a business has.
Should new hires get a phishing simulation in week one? Yes — a baseline within the first fortnight. It is a safe measurement, and it makes the later coaching concrete.
How do you make sure it happens every time? Automate it: auto-enrolment on start date, a fixed module release rhythm, and monthly per-person risk reporting. Manual checklists fail the first time the person running them is on leave.
Do contractors and temporary staff need it too? Anyone with a company mailbox or access to customer data does — they face the same phishing emails, and their compromise hurts the same way.