The Workplace Security Playbook: Habits Every Employee Needs

Most workplace breaches do not start with a genius hacker. They start with a person doing their job: answering a call from "IT", paying an invoice that looks routine, approving a login prompt to make it stop. Verizon's 2026 Data Breach Investigations Report found the human element in 62% of breaches. The habits in this playbook target exactly those moments.

The short version fits on a sticky note. Use phishing-resistant sign-in and a password manager. Verify any request for money, access or data on a channel you already trust. Keep company data in company tools, including AI tools. Report anything odd fast, and never punish the person who reports it.

This is the overview for the Security Awareness series. Each module gives the core habits for any role and setting, then links the detailed guide. Managers will find a ready-made team session near the end.

Why people are the target

Attackers go after people because people hold what software cannot easily check: the authority to pay, the power to reset a password, the habit of being helpful.

The evidence is consistent across years. In the 2026 DBIR, the human element was present in 62% of breaches, up slightly from 60% the year before. Social engineering was the third most common breach pattern, at 16% of all breaches. The FBI's 2025 Internet Crime Report logged 24,768 business email compromise complaints with reported losses of more than $3.04 billion.

Business email compromise (BEC) is fraud where an attacker uses a hijacked or spoofed account, a phone number or a meeting link to get a payment sent to them. It is not a niche crime. An FBI public service announcement counted more than $55 billion in exposed BEC losses between October 2013 and December 2023.

The patterns repeat

Almost every social engineering attempt uses some mix of these levers:

• Authority. The message claims to come from a CEO, a finance director, a regulator or IT.
• Urgency. It needs doing today, before a deadline, before you "lose access".
• Secrecy. "Keep this between us until the deal is announced."
• Helpfulness. The attacker plays someone stuck, locked out or new, and asks you to bend a rule.
• A changed detail. New bank account, new phone number, new login link, new app to install.

The channel is shifting away from email. The 2026 DBIR reports that in phishing simulations, the median click rate for phone-centric methods such as texts and voice calls was 40% higher than for email. It also notes attackers impersonating help desk agents, or users who need a password reset, with moderate success.

Common mistakes

Believing you would spot it. Good lures have no typos, arrive at a busy moment, and use a name you know. Your defence is a habit that works even when the message is convincing.

Action checklist

• Learn the five levers above and name them out loud when you see one
• Treat any request that combines urgency with money, access or data as unverified until checked
• Find out who your security contact or reporting channel is today, before you need it
• Read the AI-powered social engineering guide to see how voice and video lures now work

Accounts, sign-in and devices

Stolen or phished logins remain one of the easiest ways in, and your accounts are the front door to everything else. CISA's Secure Our World program boils the basics down to four steps: avoid and report phishing scams, use strong passwords, use multifactor authentication with a password manager, and update software.

Sign in the strong way

• Use the company password manager for every work account. Unique passwords stop one leak from opening every door.
• Turn on the strongest sign-in your company offers. A passkey or hardware security key is phishing-resistant because it will not work on a fake site. Text-message codes are weaker; see why SMS MFA is not real MFA.
• Never approve a prompt you did not start. Repeated sign-in pushes are an attack called MFA fatigue. CISA's advisory on the Scattered Spider group describes exactly this: repeated prompts until an employee pressed "Accept".
• Never read a code aloud. No real IT team, bank or vendor needs the one-time code from your phone.

The full routine, including what to do when a password shows up in a breach, is in the credential hygiene guide. If your company has not picked a password manager yet, the password manager comparison lists the criteria that matter.

Keep devices boring and up to date

Install updates when prompted rather than snoozing them. Lock your screen every time you step away. Use only approved apps and browser extensions. Away from the office, keep family off the work device and use the company VPN or secure access tool when asked. Travel, public Wi-Fi and lost devices are covered in the secure remote and mobile work guide.

Common mistakes

Reusing a work password on a personal site. Approving a prompt "just to make it stop". Leaving a laptop unlocked on a train.

Action checklist

• Move every work login into the company password manager
• Register a passkey or security key wherever your company supports one
• Deny and report any sign-in prompt you did not trigger
• Install pending updates on your work laptop and phone today
• Set your screen to lock automatically after a few minutes

Email, chat and phone requests: verify before you act

This is the module that prevents the most expensive losses. The rule is simple. Verify any request to move money, change payment details, reset access, or send data on a channel you already trust, before you act. The FBI's BEC guidance puts it the same way: use secondary channels to verify requests for changes in account information.

How to verify properly

1. Pause. Urgency is the attack, not a reason to skip the check.
2. Do not reply to the message, and do not use any number, link or contact in it. Those may belong to the attacker.
3. Look up the person yourself in the company directory, the vendor master file, or a contract you already had.
4. Call them back on that number, or message them in a separate, known channel. This is an out-of-band callback.
5. Ask about the request specifically. "Did you just ask me to change the bank details for supplier X?"
6. If you cannot verify it, do not do it. Escalate to your manager or security team instead.

The callback works even against a perfect voice or video deepfake, because the attacker does not control the number in your directory. Finance teams should pair it with dual approval; the deepfake executive fraud controls guide sets that up.

Help desk and IT impersonation

CISA's Scattered Spider advisory describes attackers posing as IT or help desk staff by phone and text. It also describes them convincing help desks to reset passwords or move a victim's MFA to an attacker's device.

Real IT will not ask for your password or a one-time code, or have you install remote access software from a link sent mid-call. Help desk staff should verify callers through a channel the caller did not choose. See help desk reset impersonation and the email bombing plus fake IT support pattern.

Red flags and what to do

CISA's phishing guidance adds the classic signs: urgent or emotional language, requests for financial information, shortened links, and wrong addresses.

Common mistakes

Calling the number in the suspicious email to "verify". Trusting caller ID, which can be spoofed. Letting seniority override the process.

Action checklist

• Save the directory numbers of your manager, finance contact and IT help desk in your phone today
• Commit to one rule: money, access or data requests get a callback on a number you already had
• Learn how your real IT team contacts people, and what it never asks for
• Never act on bank detail changes received by email alone
• Share the red flags table with your team

Handling data and using AI tools at work

Data leaks are usually quiet. Someone forwards a spreadsheet to a personal address, shares a link with "anyone", or pastes a customer list into a chatbot. Keep company data in approved places, and share only what the recipient needs.

Classification in plain words

Most companies use three or four labels:

• Public: published, or approved for anyone.
• Internal: fine for colleagues, not outsiders.
• Confidential: harmful if leaked. Customer data, salaries, contracts, source code.
• Restricted: regulated or highly sensitive, such as health records, card data or credentials.

When unsure, treat it as one level higher and ask the data owner.

Sharing, personal accounts and shadow IT

• Share to named people, not "anyone with the link". Set an expiry date on external shares.
• Do not forward work email to a personal account, even to work from home. Use the approved remote access instead.
• Do not sign up for new apps with your work email without checking. Unapproved tools (shadow IT) hold company data outside the company's control and monitoring.

AI tools: approved tools only, and check the output

AI use is now ordinary at work, and much of it happens outside approved tools. The 2026 DBIR reports that 45% of employees are regular users of AI on their corporate devices, up from 15% the year before. It also reports that 67% of users access AI services with non-corporate accounts on corporate devices. Source code was the most common data type sent to external AI tools in its data loss prevention data.

Practical rules:

1. Use the AI tools your company has approved, signed in with your work account. A personal account does not carry your employer's contract terms on how data is stored and used.
2. Do not paste confidential or restricted data into any tool that is not approved for it. That includes customer records, source code, credentials, contracts and anything under NDA.
3. Check the output before you rely on it. The UK NCSC warns that AI tools can present incorrect statements as facts, a flaw known as hallucination. Verify figures, citations, code and legal language yourself.
4. Be careful what the AI is allowed to do. An assistant that can read your email or browse can be steered by hidden instructions in content it reads, an attack called prompt injection. Do not grant extra permissions without approval.

The NCSC adds that the burden of using AI safely should not fall on individual users. If your company has no approved tool or rules, ask for them. Builders should read the threat model for AI systems.

Common mistakes

Uploading a confidential document to a free AI tool "just to summarise it". Sharing a folder publicly to send one file to a partner.

Action checklist

• Find your company's data classification labels and the approved AI tools list
• Review your sharing links and switch any "anyone with the link" shares to named people
• Stop auto-forwarding work email to personal accounts
• Never paste customer data, source code or credentials into an unapproved AI tool
• Fact-check any AI-generated number, citation or code before it leaves your desk

Physical security, in the office and at home

Physical security is where a polite stranger can walk past every digital control. Tailgating means following an authorised person through a secured door without badging in. It works because holding the door feels like good manners.

Office habits

• Wear your badge where it can be seen, and remove it in public places like cafés and trains, where it identifies your employer.
• Badge in every time, and let the door close behind you. If someone follows, say: "Sorry, I have to ask everyone to badge in. Reception can help."
• Escort your visitors from reception and back. Do not leave guests alone in work areas.
• Report, do not confront, if you are not comfortable asking. Call reception or security.

Clean desk and printing

• Clear desks of confidential papers when you leave, and lock them away overnight.
• Collect printing immediately, and use secure or "pull" printing if your office has it.
• Shred confidential paper in the secure bins, not the recycling.
• Lock your screen every time you stand up. Learn your operating system's lock shortcut so it takes one second.

At home and on the move

Keep screens away from windows and shared spaces, take confidential calls where others cannot hear, and never plug in USB drives you found or were handed at an event. The travel security checklist covers hotels and airports.

Common mistakes

Holding the door for a person carrying boxes. Leaving a printed contract on the printer. Wearing a lanyard through a busy train station.

Action checklist

• Stop holding secure doors for people you do not know; point them to reception
• Clear your desk and lock confidential paper away at the end of each day
• Collect printouts immediately and shred confidential paper
• Use the lock-screen shortcut every time you leave your device
• Set up a home workspace where screens and calls stay private

Report fast, without fear

Fast reporting is the cheapest control a company has. A click reported in five minutes is a small incident; hidden for a week, it can become a breach. For payment fraud, speed decides whether money is frozen or gone. The FBI's Recovery Asset Team reported a 58% success rate on its funds-freeze actions in 2025, freezing about $679 million. It says that time is of the essence.

What to report

• Suspicious emails, texts, calls or chats, even if you did not engage.
• Any link clicked, file opened, or code or password entered by mistake.
• Sign-in prompts or reset emails you did not request.
• Lost devices or badges, data sent to the wrong person, strangers in secure areas.
• Anything that "felt off".

How fast, and how

Report immediately, through the channel your company publishes: a report button in your email client, a help desk number, or a security inbox. CISA advises using the report option in your email or messaging tool rather than just deleting the message.

If you clicked

1. Stop. Do not enter anything else, and close the page.
2. Disconnect the device from Wi-Fi or the network if you opened a file, and leave it powered on unless told otherwise.
3. Report it right away, saying exactly what you clicked, opened or typed, and when.
4. Change the password for any account you entered on the fake page, from a different, trusted device.
5. If money moved, call your bank immediately to request a recall, then file at ic3.gov if you are in the US.

If a personal account was taken over in the process, Locked Out has step-by-step recovery through official channels.

No-blame culture is a security control

The UK NCSC is blunt about this. Its phishing guidance says "blaming users for clicking on links doesn't work" and that "users who fear reprisals will not report mistakes promptly, if at all." The person who reports a mistake has just given security a head start. Thank them.

Ransomware basics for employees

Ransomware encrypts files and often steals them first, then demands payment. The 2026 DBIR found a ransomware action in 48% of breaches it analysed, and 69% of ransomware victims in its data did not pay. Your part is small but decisive:

• Report early signs: files you cannot open, renamed file extensions, a ransom note, or a sudden slowdown across shared drives.
• Disconnect the affected device from the network and report it. Do not try to fix it yourself.
• Save work in company-managed storage that is backed up, not only on your laptop.
• Never contact the attackers or pay anything yourself.

The organisational side, backups and response plans, is in the ransomware readiness guide.

Common mistakes

Waiting until you are sure before reporting. Deleting a suspicious email instead of reporting it. Quietly changing a password and hoping nobody notices.

Action checklist

• Find and bookmark your company's reporting channel and help desk number
• Use the report button on the next suspicious message instead of deleting it
• Memorise the five "if you clicked" steps
• Thank a colleague the next time they report a mistake

For managers: run it as a 15-minute monthly habit

Annual training does not build habits. Short, regular, practical conversations do. NIST's SP 800-50 Rev. 1 (September 2024) frames training as a life cycle program aimed at behaviour change, with metrics to improve it. A monthly team habit is its smallest version.

The format

Fifteen minutes at the start of an existing team meeting, once a month:

1. Two minutes: one real story. A recent public case, or an anonymised near miss from your own company, shared with permission.
2. Eight minutes: one tabletop question. Talk through what the team would actually do.
3. Three minutes: one habit. Pick a single action from this guide and agree to do it this week.
4. Two minutes: one thank-you. Credit someone who reported something.

Tabletop questions that work

• "You get a voice note from me asking you to buy gift cards for a client today. What do you do?"
• "A supplier emails new bank details two days before a payment run. Walk me through the next ten minutes."
• "Someone calls saying they are from IT and need you to approve a login. What do you say?"
• "You pasted a customer file into an AI tool and then realised it was not the approved one. Who do you tell?"
• "You clicked a link and a login page appeared. You entered your password. What happens next?"

Avoid fear-based training

Do not name people who failed a phishing test or tie clicks to discipline. The NCSC warns that phishing simulations can erode trust between employees and security. Measure reports and time to report, not just click rates.

Model it yourself. Tell your team to call you back before acting on any money or access request from you. A process the manager overrides is one nobody follows.

Action checklist

• Add a recurring 15-minute security slot to an existing monthly team meeting
• Tell your team, in writing, that you want a callback before acting on money or access requests from you
• Pick three tabletop questions for the next quarter
• Track reports and time to report alongside training completion
• Publicly thank the next person who reports a suspicious message or a mistake

Your complete checklist

• Find your company's reporting channel and save the help desk number in your phone
• Move every work login into the company password manager
• Register a passkey or security key wherever it is supported
• Deny and report any sign-in prompt you did not start, and never share a one-time code
• Install pending updates and set your screen to lock automatically
• Verify every money, access or data request with a callback on a number you already had
• Never act on bank detail or payroll changes received by email alone
• Use only approved AI tools, signed in with your work account
• Never paste confidential data, source code or credentials into an unapproved tool
• Share files with named people, not "anyone with the link"
• Badge in every time and do not hold secure doors for strangers
• Clear your desk, collect printing immediately and shred confidential paper
• Report a click, a lost device or a misdirected email immediately, without waiting to be sure
• Managers: run a 15-minute monthly session and thank people who report