Rubens Perdomo
It’s easy to assume that younger employees are naturally good with technology.
After all, they’ve grown up with smartphones, social media, and apps. They’ve been online for most of their lives. They can pick up a new piece of software in minutes and troubleshoot a device problem faster than most of the people who manage them. So surely they don’t need much help staying safe online.
We're not considering that that's a dangerous assumption.
Comfort With Technology Isn’t the Same as Cybersecurity Awareness
Being comfortable with technology isn’t the same as understanding cybersecurity. They’re two completely different skills.
Someone can navigate half a dozen apps without thinking, switch between devices effortlessly, and solve everyday tech problems in seconds. That level of fluency is real, and it’s valuable. But it doesn’t automatically mean they’ll recognize a phishing email, spot a fake login page, or understand why reusing passwords creates a risk for the whole business.
In fact, familiarity can sometimes work against people. When you spend your whole life tapping through prompts, accepting permissions, and logging in with a single swipe, you build habits that favor speed and convenience. Those are exactly the habits attackers want to exploit. Spotting a well-crafted scam requires a different kind of attention: slowing down, questioning what looks routine, and knowing which signs to look for. That’s a learned skill, not something that comes with growing up around technology.
The Mistake of Targeting Training at the “Less Technical”
I’ve seen businesses make the same mistake repeatedly. Cybersecurity training gets tailored towards the people they think are “less technical”: the longer-serving staff, the people in administrative roles, or those who openly say they struggle with computers. Meanwhile, the newer and younger members of the team are expected to pick it up naturally, or are quietly skipped over.
The problem is that this approach rests on a guess about who is most at risk, and the guess is often wrong. Everyone has different gaps in their knowledge, and those gaps rarely line up with age or job title.
One person might recognize a suspicious email immediately, but use the same password for every account they own. Another might have excellent password habits, but happily approve an unexpected sign-in request because the prompt looks familiar. A third might be careful with email but have no idea that the public Wi-Fi they use at a coffee shop creates its own risks.
Each of those people has strengths. Each of them also has a weak spot. Training that assumes otherwise leaves those weak spots in place.
Cybercriminals Don’t Care How Old Your Employees Are
Attackers don’t sort your team by age, seniority, or technical confidence. They’re looking for the easiest way into your business, and that usually means finding the first person who trusts something they shouldn’t.
It only takes one. One convincing email, one fake login page, one approved request that should have been declined. A single mistake by any member of the team can open the door to the whole organization, regardless of how well everyone else behaves.
That’s why the strength of your business’s security depends on its least-prepared person, not its most capable one. Raising the baseline across the entire team is far more effective than focusing on a handful of people and hoping the rest will manage.
Training Works Best When Everyone Takes Part
That’s why cybersecurity training works best when it’s something the whole business does together.
When training is universal, a few things happen. Everyone hears the same messages and uses the same language, which makes it easier to talk about threats and report concerns. Nobody is singled out as being “bad with technology,” so there’s no stigma attached to taking part. And leadership is included too, which sends a clear signal that security is a shared responsibility rather than an IT problem or something that only applies to certain people.
It also means your business moves in the same direction. Instead of a patchwork of individual habits, you build a consistent standard of behavior that everyone understands and follows.
Training Needs to Reflect How People Work Today
Training also needs to reflect how people actually work today, which looks quite different from a few years ago.
A lot of work now happens on mobile phones. Staff approve sign-in requests while they’re traveling. They open documents on personal devices. They reply to emails between meetings, often while walking or multitasking. They switch constantly between business and personal apps, sometimes within the same minute.
That creates opportunities for mistakes that simply didn’t exist a few years ago. A small screen makes it harder to inspect a link or check a sender’s address. A notification that appears in the middle of something else is easy to approve without thinking. A personal device might not have the same protections as a company-managed one.
Good training helps people recognize these situations before they become a problem. It uses realistic examples that match what your team actually experiences day to day, rather than generic scenarios that feel distant from their working lives. The more relevant the training feels, the more likely people are to remember it when it counts.
Building a Culture Where Asking Questions Is Normal
Training isn’t only about knowledge. It’s also about culture.
A healthy security culture is one where asking questions is completely normal. If somebody receives an unexpected email, or isn’t sure whether a login request is genuine, they should feel comfortable checking before they continue. They shouldn’t worry about looking foolish, wasting someone’s time, or being judged for raising a concern that turns out to be harmless.
That’s a much better outcome than hoping they’ve made the right decision on their own. A quick check that turns out to be nothing costs a few minutes. A mistake that goes unreported can cost a great deal more, particularly if nobody finds out about it until the damage is done.
Businesses that encourage this kind of openness tend to catch problems earlier. People report suspicious activity sooner, admit mistakes faster, and help each other spot threats. That’s far more valuable than a team that stays quiet out of embarrassment.
Keeping the Whole Business Moving in the Same Direction
Making cybersecurity training something everyone takes part in helps keep the whole business moving in the same direction. It closes the gaps that come from assumptions about who needs help and who doesn’t, it reflects the reality of how your team works, and it builds the kind of culture where good decisions become the default.
No one is too young, too experienced, too technical, or too busy to benefit from it.
Let’s Talk About Your Team’s Training
If it’s been a while since your team received cybersecurity awareness training, or you’re relying on people to work things out for themselves, we can help.
Get in touch today and let’s talk about a practical approach that works for everyone in your business.
