Trade shows are built around quick introductions, useful conversations and a willingness to share enough information to keep a deal moving. Those same habits can help an attacker sound legitimate. A person may approach a stand, scan a badge, offer a helpful USB drive, ask about a product roadmap or follow up from a lookalike account.
This guide shows how to train sales teams to avoid social engineering at trade shows without making genuine prospects feel unwelcome. The goal is not to make salespeople suspicious of everyone. It is to give them a small set of decisions that protect information, devices and customer trust while the event is busy.
TL;DR
- Decide before the event what sales staff may share, demonstrate, photograph and promise.
- Teach a simple pause, verify and report response for unusual requests, links, QR codes, devices and urgent follow-ups.
- Keep demos, credentials, customer data and internal roadmaps in approved environments rather than on an exposed laptop.
- Give staff polite scripts so a security check does not feel like a confrontation.
- Practise stand-floor, phone, chat and post-event scenarios without collecting real credentials.
- Review contacts and access after the event; a suspicious conversation can continue long after the stand closes.
Why trade shows create social-engineering risk
A trade show compresses many trust signals into one place. People wear badges, stand beside branded displays, share job titles and move between conversations quickly. A visitor may know the company name, the event theme or the salesperson’s public profile before asking for something sensitive. Familiar surroundings can make an unusual request feel normal.
The Australian Cyber Security Centre describes social engineering as manipulating people into opening attachments, visiting websites, revealing credentials, disclosing information or transferring funds. Sales staff are exposed because they work with external parties, handle business context and are rewarded for helpful conversations. That is not a reason to keep them away from events; it is a reason to train the specific choices they make there.
A strong programme protects both sides of the conversation. It helps a salesperson avoid disclosing information, and it gives a genuine visitor a clear explanation when the answer needs checking.
1. Set information boundaries before the event
Sales staff should not have to decide at the stand whether a detail is public, internal, confidential or customer-owned. Create a one-page event brief with examples from the products and markets the team will discuss.
Separate information into three practical groups:
- Safe to share: published features, approved case studies, public documentation and the event’s advertised messaging.
- Check before sharing: unreleased features, pricing exceptions, customer names, architecture details, security responses and partner information.
- Never share at the stand: passwords, MFA codes, private customer records, source code, active incident details or an internal system screen.
Give a named product, legal or security contact who can approve an answer. If the person is unavailable, the safe answer is to take the question away and follow up through the known business channel. Use a cyber security gap assessment to map the owners and escalation routes before the event.
2. Brief each role on the decisions it makes
A booth host, account executive, solutions consultant and executive will encounter different requests. A booth host may be asked for a product roadmap. A solutions consultant may be asked to connect a visitor’s device to a demo network. An executive may receive a direct message asking for a document or a meeting change.
Run a short briefing for each role. Cover the information boundaries, approved demo environment, contact-capture rules, lost-device route and the person who can stop an unsafe action. Avoid a generic warning that says ‘be careful online’; show the actual situations the team will face.
Give staff a three-step rule they can remember: pause the request, verify through a known channel, report anything suspicious. The ACSC’s social-engineering guidance supports this approach and emphasises avoiding engagement with suspected attempts while preserving and reporting the communication.
3. Teach polite verification scripts
Salespeople often bypass a check because they do not want to interrupt a promising conversation. Scripts make the safe response feel professional rather than obstructive. Practise lines such as:
- ‘That detail is worth checking; I will confirm it with our product owner and send the approved answer.’
- ‘I cannot connect an unknown device to this demo environment, but I can show the public version on our stand device.’
- ‘For customer information, we use the formal request process so the right person can respond.’
- ‘I will message you through the contact details on your company’s official site rather than use this new link.’
The salesperson should not explain which internal control the visitor has failed. A short, neutral boundary is enough. If the visitor is genuine, the explanation protects both organisations.
4. Protect demos, devices and credentials
Use a prepared demo account with the smallest useful permissions and no real customer data. Remove saved browser sessions, downloads and personal accounts from the event laptop. Turn on the organisation’s required screen lock, updates, encryption and MFA before departure.
Do not let a visitor install software, connect a USB device, scan an unexpected QR code into a work account or ‘help’ configure the laptop. If a device needs technical support, use the organisation’s known support route. Keep laptops and phones under staff control, and lock the screen whenever the device is left unattended.
The rule also applies to phones. A QR code on a poster, badge or handout can lead to a sign-in page or a form that asks for more information than the event needs. Open the official app or type the known address yourself when a follow-up is necessary. Never enter a password or one-time code into a page reached from an unexpected message.
5. Separate contact capture from access
Badge scans and lead forms can be useful without becoming an access path. Collect only the information the approved sales process needs, explain what will happen next and do not accept a visitor’s request to change a customer record, reset an account or add a new administrator as part of a casual conversation.
A person who knows a customer’s name may still be impersonating them. Route changes, payment details, support access and security questionnaires through the established owner and verification process. Sales should be able to record the request without promising that it can be actioned immediately.
Make the hand-off visible in the CRM or approved lead system. Avoid keeping sensitive notes in a personal phone, paper notebook left at the stand or an unapproved messaging app.
6. Practise common event scenarios
Use short role-play before the team travels. Let the salesperson decide what to do, say the script aloud and identify the report route. Include scenarios such as:
- A visitor asks for an unreleased feature list and says a competitor already provided it.
- Someone claiming to be an event organiser requests a login or asks staff to install a venue application.
- A new contact sends a QR code and says the discount expires in ten minutes.
- A familiar customer name appears in a chat asking for an urgent file or payment change.
- A photographer or visitor asks to take a close-up picture of a screen showing a customer workflow.
- A colleague’s phone is lost and a person offers to help move the MFA account to a new device.
A phishing simulation can support the email and message part of the exercise, but the briefing should also cover face-to-face pressure, voice calls and chat. Stop every simulation before a real credential, device change or customer action occurs.
7. Make reporting safe and immediate
A salesperson who reports early should receive help, not a lecture. Give staff one route for a suspicious message, lost device, accidental disclosure, unexpected visitor request or unusual support contact. Put the route in the event brief and save it offline.
Ask the reporter to preserve the message, note the time and location, identify the device or account involved and avoid continuing the conversation. They should not delete evidence, forward a suspicious file to colleagues or try to investigate the visitor personally.
Use human risk reporting to combine training, scenario results and follow-up actions when the organisation’s data-handling rules allow it. Keep individual information limited to people who need it for response and coaching.
8. Close the loop after the event
The risk continues when the team returns to the office. Review newly created contacts, direct messages, shared files, demo accounts, temporary access and event devices. Remove accounts or sessions that were created only for the event and move approved follow-ups into the normal sales process.
Ask each team member three questions: What request felt unusual? What information did you hold back? Where did the process slow you down? Use the answers to update the next event brief. If a prospect’s question needs a product or security response, make sure the approved answer travels through the known channel rather than an ad hoc personal message.
For an event with a suspected compromise, contact security immediately. The right response may include isolating a device, revoking sessions, resetting access or notifying an affected customer. Let the response team decide; sales should not delay a report while trying to preserve the relationship alone.
9. Measure the behaviours that matter
Attendance is useful but not enough. Track whether staff completed the pre-event briefing, used the approved demo environment, reported suspicious requests, completed post-event checks and closed temporary access. Review the quality of information shared and the time from a report to the first response.
Do not turn the result into a league table of salespeople. A higher report rate may mean the team is using the process correctly. Review trends by event, role and scenario type, then coach the behaviour that needs attention.
Use the Cyber Aware comparison page to frame requirements for role-based learning, phishing practice and human-risk evidence when selecting or reviewing a programme.
Troubleshooting
Staff say the rules make conversations awkward
Give them the scripts and a fast approval route. A short ‘I will confirm that and follow up’ sounds more professional than an uncertain answer or an unsafe promise.
A visitor insists that the request is urgent
Treat urgency as a reason to verify, not as proof. Pause the action, use the known contact and involve the event lead or security contact if pressure continues.
A prospect asks for a live technical demonstration
Use the prepared environment with limited permissions and synthetic or approved data. Do not connect a visitor’s device or expose an internal console to make the demo more convenient.
A salesperson clicked an event-related link
Stop further interaction and report it through the approved route. The response team can decide whether the device, account or session needs attention; the salesperson should not hide the click or continue exploring the page.
FAQ
Why are sales teams targeted by social engineering at trade shows?
Sales teams work with external people, share business context and often need to respond quickly. An attacker can use the event name, public role information or a plausible business request to make an unusual action feel routine.
What should salespeople never share at a trade show?
They should never share passwords, MFA codes, private customer records, source code, active incident details or access to internal systems. Unreleased product, pricing, architecture and partner information should be checked through the approved owner first.
How can sales staff verify a prospect’s request?
Pause the request and use a known company contact, approved CRM record or named internal owner. Do not rely on a new link, caller ID, badge, social profile or urgency as proof.
How do you train sales teams to resist social engineering?
Set clear information boundaries, practise event-specific scenarios, give staff polite verification scripts, protect demo devices and make suspicious requests easy to report. Repeat the practice before major events and after a real near miss.
Should sales teams use personal devices at trade shows?
Follow the organisation’s device policy and prefer managed equipment for business work. Personal devices should not become a workaround for accessing customer data, internal systems or event files.
What should happen after a trade show?
Review contacts, messages, shared files, event accounts and devices; remove temporary access; report suspicious interactions; and route legitimate follow-ups through the normal approved process.
One last thing
Security training should help salespeople keep a good conversation moving without making an unsafe promise. A pause, a known verification route and a simple reporting habit protect the deal as well as the data.
What to do next
Create the one-page event brief, prepare the restricted demo account, test the offline incident contact and run six role-play scenarios with the sales team before the next trade show. Use security awareness training to give the team a common baseline, then tailor the practice to the event and the information it exposes.
Sources
- Social engineering, Australian Cyber Security Centre guidance, last updated 9 April 2026.