Staff who travel for work carry your attack surface through airport wifi, hotel networks, and unfamiliar SIM cards, and most security awareness programs never adjust for that. Cyber security training for staff travelling for work needs a different rhythm than desk-based training: shorter, faster to deliver, and built around the scams that actually target people on the move.
TL;DR
- Cyber security training for staff travelling for work should run as a 15-20 minute pre-departure briefing, not a slide deck buried in onboarding.
- Vishing and smishing spike on international trips because roaming numbers and hotel front desks look plausible to attackers — train on both before departure.
- Cyber Aware's approach: mobile-first modules that work offline beat email-based LMS links when staff have no company wifi.
- Set a 24-hour incident reporting rule for travelling staff so a lost device or clicked link doesn't sit unreported until they're back at the desk.
Why this matters
A staff member on the road is easier to impersonate and harder to protect. They're using unfamiliar networks, checking email on personal hotspots, and fielding calls from numbers they don't recognise — all of which look completely normal on a business trip and completely different from a phishing red flag at the office desk.
Attackers know this. Vishing calls pretending to be IT support, fake hotel wifi portals, and SMS "your flight is delayed, click here" messages all target the exact conditions of business travel. Training staff to identify vishing and voice phishing calls matters more on the road, where a call from an unknown international number gets picked up out of habit, not suspicion.
In 2026, the fix isn't a longer training module — it's a shorter one, delivered at the right moment, covering the specific risks of being away from the usual office setup.
What you'll need
- A pre-departure checklist (device, network, and reporting steps) that takes 15-20 minutes to complete
- Mobile-capable training content that works without a company wifi connection
- MFA enabled on every account staff will access while travelling
- A documented VPN policy staff can follow without IT on the phone
- A named point of contact for security incidents reachable across time zones
- A short list of common travel scams relevant to the destination (roaming smishing, fake hotel portals, vishing calls)
The steps
1. Run the pre-departure briefing at least 48 hours out
Book the briefing before the trip is locked in, not the morning of. A 15-minute session covering device settings, wifi rules, and who to call if something goes wrong sets the tone before jet lag and packing take over. Skip the full annual training module here — travel briefings work better as a short refresher layered on top of existing training.
Common mistake: scheduling it for the day of departure, when staff are distracted and skim it.
2. Lock down devices before the laptop leaves the building
Confirm MFA is active on email, VPN, and any client-facing tools the staff member will use abroad. Full-disk encryption should already be standard, but travel is the moment to check it's actually turned on, not assumed.
Expected outcome: a device that's useless to a thief within minutes of being lost, not hours.
3. Train on public wifi and shared network risks specifically
Hotel business centres, airport lounges, and conference wifi are the three networks most likely to sit between a travelling employee and a credential-stealing captive portal. Teach staff to connect to VPN before opening anything work-related, every single time, not just when it's convenient.
Common mistake: staff assume hotel wifi requiring a room number and surname is "secure" because it asked for credentials at all.
4. Cover vishing and impersonation calls before international numbers start showing up
A call from an unlisted number claiming to be the hotel front desk, a rideshare driver, or IT support asking to "verify" a password is a standard vishing play, and it works better on travelling staff because unfamiliar numbers are expected. How to train staff to identify vishing and voice phishing calls walks through the scripts attackers use and how to teach staff to hang up and call back on a verified number.
5. Cover SMS and roaming scams before staff switch SIMs
Roaming SMS messages about "customs fees," "flight changes," or "data plan upgrades" spike the moment a staff member's phone connects to a new carrier abroad. Security awareness training for smishing and SMS scam prevention covers the exact patterns to flag before staff tap a link out of travel-day confusion.
Common mistake: assuming smishing training delivered months earlier still sticks once staff are jet-lagged and expecting travel notifications.
6. Plan for staff without reliable company email access
Some travelling staff — contractors, field teams, staff in low-connectivity regions — end up working from personal devices or personal email temporarily. How to train staff without a company email address sets rules for that scenario before it happens on a trip, rather than improvising mid-travel.
7. Set a 24-hour incident reporting rule
A clicked link, a lost badge, or a suspicious call reported three days late is far harder to contain than one reported within 24 hours. Give travelling staff a single contact method — a phone number, not just an email — that works across time zones. Under Australia's Notifiable Data Breaches scheme, entities generally have 30 days to complete an assessment once a breach is suspected, and that clock runs faster when the first report lands promptly.
8. Debrief after the trip
A 10-minute post-trip check — did anything feel off, did any call or message seem suspicious — catches incidents staff didn't think were worth reporting in the moment. Log it. Patterns across multiple trips (same scam type hitting different staff) tell you where to tighten the next briefing.
Build travel-ready security training
See how Cyber Aware runs short, mobile-first briefings for staff on the road.
Troubleshooting
- Staff skip the briefing because they're "too busy packing." Cap it at 15 minutes and send it as a calendar invite tied to the travel approval, not a standalone email.
- No internet access to complete training modules abroad. Use offline-capable mobile training rather than an LMS link that dies the moment wifi drops.
- Time zone gaps delay incident reporting. Publish one phone number that's monitored across time zones, not an inbox that gets checked at 9am local time.
- Contractors and offshore staff hit language barriers. Run multi-language training content where the team includes non-native English speakers, especially for phishing scenario examples.
- Staff connect via personal hotspot to "avoid the hassle" of VPN. Make VPN connection a hard gate in the device policy, not a recommendation.
Tools and resources
- Offline-capable mobile training modules for staff without consistent wifi
- A documented VPN and MFA policy staff can follow without calling IT
- Security awareness training built for remote and distributed teams, which overlaps heavily with travel scenarios since both remove staff from the office network
- A single, time-zone-agnostic incident reporting line
- A pre-departure checklist template reused for every trip, not rebuilt each time
What to do next
Travel training only works if the baseline is already solid. If staff can't reliably spot a phishing attempt at their own desk, a 15-minute travel briefing won't fix that on the road. Start with how to train staff to recognise cyber security threats as the foundation, then layer the travel-specific steps above on top before the next trip is booked.
FAQ
What's the best way to train staff on cyber security risks while travelling?
A short pre-departure briefing of 15-20 minutes covering device lockdown, public wifi rules, and incident reporting works better than a long annual module. Cover vishing and smishing specifically, since both spike during travel.
Is a VPN enough to protect travelling staff on hotel wifi?
A VPN protects data in transit but doesn't stop staff from entering credentials into a fake captive portal before the VPN connects. Training staff to connect to VPN before opening any work app closes that gap.
How much time should a travel security briefing take?
Fifteen to twenty minutes is enough to cover device settings, network rules, and who to call if something goes wrong. Longer sessions get skipped in the days before a trip.
Do contractors travelling for work need the same training as employees?
Yes, especially since contractors often use personal devices and email more than employees. Training staff without a company email address covers the gaps that standard onboarding misses.
How quickly should a travelling staff member report a suspected phishing click?
Within 24 hours, ideally immediately. Faster reporting shrinks the window an attacker has to use stolen credentials and gives IT time to act before the staff member is even back in the office.
Are vishing calls more common when staff are travelling?
Yes. Unfamiliar international numbers and hotel front desk calls are expected during travel, which makes impersonation calls harder to spot than they would be at a home office.
Can travel security training be delivered without company wifi?
It should be. Mobile-first, offline-capable modules work better than LMS links that require constant internet access, since travelling staff often have unreliable connections.
Should security training differ by destination?
Yes to some degree — roaming SMS scams and fake customs fee messages are more common on international trips, so briefings for overseas travel should cover smishing specifically.
One last thing
The single highest-leverage fix for travel security isn't a longer training module — it's making VPN connection automatic before a device can reach any work app, so the human decision to "just quickly check email" on hotel wifi never gets the chance to go wrong. Cyber security training for staff travelling for work should assume that decision will happen, and remove it from the staff member's hands entirely.