Executive assistants and personal assistants are among the most targeted people in any organisation: they act on their executive's behalf, they move money, and they sit on the email thread between the boss and everyone who wants something from the business. Security awareness training for executive assistants is a monthly programme of 10-minute modules plus simulated phishing that covers payment-redirect fraud, executive impersonation, calendar and travel scams, and data handling - and it is trained as a role-specific track, not as generic staff training. This guide sets out what the training must cover, how the cadence works and what evidence you keep.
TL;DR
- EAs and PAs are targeted because they approve, schedule and pay on someone else's authority.
- The core threats are business email compromise, fake meeting invites, travel and gift-card scams, and invoice redirection.
- Effective training is monthly, role-specific, and drills a verification habit for every request that changes money or access.
- Evidence matters: completion records, phishing results and policy acknowledgements support Essential Eight and insurer requirements.
Why executive assistants are a target
An assistant holds a combination few other roles have: delegated authority to commit the executive's time, frequent access to finance processes, and a working relationship with suppliers, board members and clients. Attackers exploit that combination in business email compromise (BEC) - a fraudulent email that impersonates a senior person or a trusted supplier to redirect a payment or extract information.
The pattern is usually quiet. A message arrives from what looks like the CEO's address, often sent while the executive is travelling. It asks for something urgent and confidential: an updated bank detail for a supplier, a purchase of digital gift cards, or a document sent to a personal address. There is no malware for a filter to catch, because the attack is the message itself.
The six threats training must cover
- Executive impersonation. Email or messaging that appears to come from the executive, requesting payments, credentials or files. Includes spoofed addresses, lookalike domains and compromised mailboxes.
- Payment and invoice redirection. A "supplier" emails new bank details ahead of a real invoice. The funds go to the attacker's account.
- Fake meeting and calendar invites. Invites carrying malicious links or used to harvest acceptance data and internal contact details.
- Travel booking fraud. Fake hotel confirmations and flight-change emails that harvest card details at the moment of booking.
- Gift card and urgent-action scams. Small-value requests framed as confidential favours for the executive, designed to be handled without the usual checks.
- Voice and messaging impersonation. Approaches through SMS, WhatsApp or phone calls posing as the executive or an urgent contact, increasingly with AI-generated voice.
How the training cadence works
The programme runs on a monthly rhythm so it never becomes a once-a-year compliance chore:
- One short module a month, 5-10 minutes, on one of the six threats above, sequenced so the highest-risk topics land in the first quarter.
- A phishing simulation each month tailored to the assistant's role: an executive impersonation email, a supplier bank-detail change, a fake travel confirmation. Anyone who clicks gets immediate, blame-free micro-training.
- A reporting drill. Every simulation reinforces the same action - report with one click, then verify with the real person through a second channel.
- Quarterly policy touchpoints: password and MFA policy, acceptable use, and the organisation's payment-verification procedure.
The habit that matters most is verification: any request that changes bank details, buys gift cards, sends files externally or shares credentials gets confirmed through a second, known channel - a phone call to a saved number, not a reply to the email.
What evidence the programme produces
For an organisation working toward Essential Eight, SMB1001 or an insurer's requirements, training records are part of the story. The programme should produce, and retain:
- Completion records per module, per staff member, with dates.
- Phishing simulation results over time - click rate trending down, report rate trending up.
- Policy acknowledgement records.
Cyber Aware runs this as an automated monthly cadence: enrolment, course drops, reminders, simulations and remediation run on a schedule, and the results roll up into human risk reporting you can hand to an auditor, a board or an insurer. The security awareness training page covers what the full module library includes.
Getting the executive on board
The training works best when the executive is part of it. Two moves make that easy:
- Agree the verification rule together. Write down the one-sentence rule: any payment change, credential request or external file transfer is confirmed by calling a known number. Then both people follow it, including when the executive is the one making the request.
- Run executives and their assistants through the same simulations. Whaling-style simulations that target the executive and their assistant as a pair test the whole chain, not just one link.
FAQ
Is security awareness training required for executive assistants specifically? No standard names the role, but Essential Eight maturity levels, SMB1001 and most cyber insurance applications require staff awareness training overall - and a role-specific track for the people who handle payments and credentials is the practical way to satisfy it meaningfully.
How long does the training take each month? About 10-15 minutes: one 5-10 minute module plus a phishing simulation exercise. It is designed to fit around a working day, not to interrupt it.
What is the single most important habit for an assistant to build? Out-of-band verification: confirming any request that changes money, access or data by calling the real person on a number you already have - never by replying to the message that made the request.
Can the training cover my organisation's own procedures? Yes. Role-specific tracks pair the standard content with your payment-verification procedure, reporting contacts and internal escalation path so the drills rehearse the steps your organisation actually uses.
What results should we expect in the first three months? Report rates rise first as staff learn the one-click report habit, then click rates fall as recognition improves. Trend the numbers monthly rather than judging a single simulation.