Phishing awareness training: what a good programme for employees covers

Why phishing training matters for Malaysian organisations

Most cyber incidents and payment frauds start with a person being persuaded to do something: click a link, type a password, approve an MFA prompt, install an app or change a supplier’s bank details. Technical filters catch a lot, but not everything, and attackers keep moving to channels the filters do not see, such as WhatsApp messages and phone calls.

The local numbers back this up. In a written reply to the Dewan Negara in September 2025, the Digital Ministry said CyberSecurity Malaysia recorded 3,258 phishing incidents in 2024, about 77% of the 4,219 fraud cases reported to it, and 2,227 phishing incidents in January to July 2025. Those are only the incidents people reported, so the real figure is higher.

For employers the risk is not only to the company. Staff who are scammed personally bring stress, debt and sometimes compromised devices to work. A programme that teaches people to spot social engineering protects both.

What phishing and social engineering look like today

Training that only shows badly spelled e-mails from a foreign prince is out of date. Cover the forms your staff actually see:

What a good phishing awareness programme covers

Whether you build it yourself or buy it, an effective cyber security awareness training programme for employees usually has these parts:

1. A short baseline for everyone. How phishing works, the common red flags, why urgency and authority are used, and exactly how to report. Ten to twenty minutes is enough to start.
2. Practice on realistic scenarios. People learn by making the call themselves: is this e-mail real, should I scan this QR code, what do I say to this caller. The WorkQuest2U Phishing & Social Engineering lesson puts staff in a 3D office where they inspect messages, spot the red flags and choose what to do, then shows the consequence of each choice.
3. Account protection. Strong passphrases, password managers, MFA and what to do when an MFA prompt appears unexpectedly. See Passwords, MFA & Identity.
4. Role-specific modules. Finance and procurement staff need payment fraud and supplier impersonation (Payment Fraud & Scams). Executives and their assistants need deepfake and CEO fraud. HR needs fake job applicants and payroll diversion. IT and helpdesk need password-reset social engineering.
5. Phishing simulations. Regular test e-mails or messages that mimic real attacks, followed by an immediate short lesson for anyone who clicks.
6. Refreshers. Short monthly or quarterly items, ideally tied to current local scams, rather than one long annual course.
7. Records. Completion and scores by person and department, which you will need for audits, cyber insurance questionnaires and Board reporting.

How to run phishing simulations fairly

Phishing simulation is useful, but done badly it destroys trust. A few rules keep it effective:

• Train before you test. Run simulations only after staff have had the baseline lesson, so a click is a learning moment, not a trap.
• Tell people the programme exists. Announce that simulations will happen without saying when. This is the honest approach and it still works.
• No naming and shaming. Results go to the individual and to aggregate department reports. Do not post lists of people who clicked.
• Vary difficulty and channel. Mix easy and hard tests across e-mail, SMS and QR codes. Using only one template trains people to spot that template, not phishing.
• Avoid cruel lures. Fake bonus, retrenchment or medical result e-mails may be realistic, but they hurt morale. Agree the limits with HR first.
• Get the legal basics right. Simulations that collect any personal data should follow your PDPA notice and data retention rules, and should never capture real passwords.
• Reward reporting. Thank people who report, including when they report a real e-mail that turns out to be harmless.

Measuring whether training works

Click rate on its own is a weak measure, because it depends on how hard the test was. Track a small set of numbers over time:

Report these to management every quarter, alongside real incidents. A rising reporting rate is the clearest sign that the culture is changing.

Choosing a phishing awareness training provider

When comparing options, ask:

• Is it local? Examples should use Malaysian banks, couriers, government agencies, e-wallets and the scams people here actually receive, in the languages your staff use.
• Does it cover more than e-mail? Messaging apps, calls, QR codes, malicious apps and deepfakes should all be in scope.
• Is it interactive? Staff should make decisions and see consequences, not just watch a video and tick a quiz.
• Is it short? Lessons that fit into a work break get completed. Hour-long modules get skipped.
• Does it work on phones? Many frontline and field staff do not have a work laptop.
• What reporting do you get? Completion, scores and certificates by department, exportable for audits.
• Does it link to response? Staff should also know what to do after a mistake, including reporting scams. Our guide on how to report a scam in Malaysia covers that.

The WorkQuest2U Cybersecurity topic groups the phishing, MFA, device, data handling and incident response lessons into one certificate, with a separate Scam Prevention certificate for teams that handle customer money or contact. Each lesson is a short 3D scene where staff practise spotting red flags, and it runs in a browser on a phone or PC.

Training is one layer, not the whole defence

Even well-trained people make mistakes when they are tired or rushed. Put these controls next to the training:

• MFA on e-mail, VPN and finance systems, using app or key based methods rather than SMS where possible.
• A one-click “report phishing” button or a single address everyone knows.
• A written rule that bank detail changes and urgent payments are verified by call-back, signed off by a second person.
• An incident plan that says who to call when someone has clicked, so they report quickly instead of hiding it. See Ransomware & Cyber Incident Response.

Members of the public and organisations can also report phishing and other cyber incidents to Cyber999, the incident response centre run by CyberSecurity Malaysia. If money has already been transferred, call the National Scam Response Centre on 997 straight away.