Security Awareness Training that teaches your team to spot the scam
Security awareness training from Granite Tech teaches your employees to recognize phishing emails, spoofed senders, fake invoices, and social engineering calls before anyone clicks, pays, or hands over a password. Short role-based lessons, simulated phishing tests, and 10-minute quarterly micro-trainings keep those habits sharp all year, run by a Montana team that has supported local businesses since 2003.
Hi,
Our bank has changed. Please send today’s payment to the new account in the attached invoice so your order is not held. I am in meetings all day, so email only, please don’t call.
3Invoice_Updated.zip
4Most attacks start with a person, not a server
Firewalls and spam filters stop a great deal, but the attacks that get through are aimed at people: a password reset email, a vendor invoice, a phone call to the front desk. One click or one wire transfer can lead to downtime, lost data, and hard conversations with customers about their information.
Security awareness training is the human layer of our cybersecurity services. Nobody needs to become a security expert. Your team needs to know what these attacks look like in their own inbox and on their own phone, and the habit of pausing before they act.
A message that looks legitimate, like an unexpected password reset, asks the employee to click and re-enter their credentials on a fake sign-in page. The attacker then uses those credentials to get into your network.
The attacker registers an address that is one character off, such as bill@rnicrosoft.com instead of bill@microsoft.com, and impersonates someone with influence over the target, so the request feels hard to refuse.
Finance staff get fake vendor invoices and “updated banking details,” and owners get executive-targeted phishing, known as whaling, built to move money before anyone checks.
A caller asks the receptionist for employee details, a password reset, or a remote session, using a confident story and a little research to sound like they belong.
A laptop left unlocked in a coffee shop or a phone lost on a job site can expose the whole network, which is why device security belongs in every bring-your-own-device policy.
Spot the red flags in this email
This is the kind of exercise our training uses. The email below has five warning signs. Click or tap anything that looks wrong, and the panel explains what gave it away and what to do instead.
Dear user,
We detected unusual sign-in activity on your account. To avoid losing access to your email and files, confirm your password now.
Verify My Account
Full details are in the attached security notice.
Security_Notice.html
Check who really sent it, what it is pushing you to do, and where the link and attachment would take you. Every red flag you find opens a short explanation here.
Hint: start with the sender’s address, not the display name.
Look closely at rnicrosoft-secure.com. An “r” and an “n” side by side read as an “m” at a glance. Attackers register lookalike domains because most people only read the display name, especially on a phone.
Do instead: tap or hover on the sender name to see the full address, and treat any near-miss spelling as a scam.
Pressure is the oldest trick in phishing. A threat to cut off your email right away is designed to make you act before you think or ask anyone.
Do instead: slow down. Check the account by signing in the way you normally do, or ask your IT team, never through the email itself.
A generic greeting is a sign the same message went to thousands of inboxes. On its own it proves little, but paired with the other warning signs it should raise your guard.
Do instead: count the warning signs. Two or more means stop and report.
The button says Verify My Account, but the link behind it points to an unrelated web address dressed up with words like “login” and “secure.” That page will look like a real sign-in screen and capture whatever you type.
Do instead: never enter a password from an email link. Go to the site or app directly.
An .html attachment opens a fake sign-in page right on your computer, which can slip past filters that only check links. Unexpected .zip files and macro-enabled documents deserve the same suspicion.
Do instead: do not open unexpected attachments. Report the message so others on your team are warned.
Deleting a phishing email protects one inbox. Reporting it lets your IT team block the sender and warn everyone else who received it. Good training makes reporting quick and positive, never a source of blame.
Remember: sender, urgency, greeting, link, attachment. Check them every time something feels off.
Simulated phishing tests work the same way, safely, inside your real inboxes, with instant feedback for anyone who clicks.
Six parts of a training program that sticks
One annual video everyone clicks through and forgets does not change behavior. A working security awareness training program has six moving parts, and Granite Tech handles the setup, scheduling, monitoring, and updates for each one.
Your policies, the common threats, and how to report something suspicious, covered as part of the IT onboarding checklist before a new employee handles sensitive information.
Realistic practice emails land in real inboxes. Anyone who clicks gets immediate feedback, and the results show which teams need more practice.
Finance learns invoice and wire fraud, HR learns to protect employee data, and leadership learns executive-targeted phishing. Nobody sits through content that does not apply to them.
Ten focused minutes each quarter on the threats circulating right now, so awareness stays current instead of fading by spring.
Everyone learns who to contact, what to document, and what to disconnect when something looks wrong, so the first 10 minutes of an incident go right.
Completion, quiz scores, and simulation results by department, giving you documented proof of training for insurers, partners, and auditors.
Training works alongside the technical layers: email security filters most phishing before it arrives, endpoint security protects every laptop and workstation, and threat detection and response watches for whatever still slips through.
Training matched to what each role can actually reach
A front desk employee, a bookkeeper, and your IT administrator face different attacks, so their training should not be identical. We map each role to its level of system access and assign the lessons that match its real exposure. People with access to money, personal data, or the whole network get the deepest training, which also addresses insider threats and internal risk.
| Role | Access level | Training focus |
|---|---|---|
| Executive and ownershipOwner, CEO, president | High | Executive phishing (whaling), wire fraud, credential security, data governance |
| Finance and accountingBookkeeper, controller, AP and AR | High | Invoice fraud, wire transfer scams, access controls, multi-factor authentication |
| Human resourcesHR manager, HR coordinator | High | Data privacy, secure file handling, social engineering, insider threat awareness |
| IT and technical staffIT admin, systems admin | Highest | Advanced threat response, patch management, privilege management, incident response |
| Operations and managementOffice manager, store manager | Medium-high | Policy compliance, incident reporting, physical security, vendor communication |
| Sales and customer serviceSales rep, front desk, CSR | Medium | Phishing recognition, password hygiene, customer data handling, social engineering |
| Field and warehouseTechnician, driver, warehouse staff | Low | Device security, safe Wi-Fi use, phishing basics, physical device protection |
Role-based modules repeat each year with refreshers in between, and results are tracked by department and position so you can see which teams need reinforcement.
Ten minutes a quarter keeps the habits fresh
Long annual sessions get forgotten. Quarterly micro-trainings are focused 10-minute lessons on the threats circulating right now, delivered on a regular schedule so your team never goes a full year without a security touchpoint.
There is no all-day event to plan around and very little lost productivity. Over time, the short, steady repetition turns awareness into instinct: people flag suspicious messages, ask before they act, and catch the scam that a filter missed.
Topics change with what attackers are doing. The rotation on the right is an example of how a year can cover the most common threats facing a small business.
Other topics in the library: safe browsing, data handling and privacy, and why software updates matter.
From a first conversation to a team that reports the scam
Every program starts with a 30 to 45 minute discovery call about your team, your industry, and any insurance or compliance requirements. From there, the work follows four steps.
Map roles and access
We sort your staff by role and system access so each person is assigned the training that fits their exposure.
Orientation and first test
Everyone completes the core security orientation, and a first phishing simulation shows where your team stands today.
Steady practice
Quarterly micro-trainings and periodic simulations keep threats current, with role-based refreshers each year.
Measure and adjust
Results by department show who needs reinforcement, and we review progress during Healthy Business Security Reviews.
Cost, insurance, and what your staff will actually notice
What decides the cost
Security awareness training is included in Granite’s managed workstation service, so clients on managed IT services do not pay for a separate training platform or a dedicated security trainer.
Managed IT scales per user, so the size of your team is the main factor. A discovery call and a written proposal set the exact scope and price.
Insurance and compliance
Cyber insurers increasingly ask whether you run documented, regular employee training, and a structured program can work in your favor on policy terms.
Healthcare, financial services, and any business handling payment card data are often required to show regular training. Tailored, documented training helps satisfy those obligations for healthcare IT clients and financial firms alike.
What your staff experiences
Short, plain-language lessons built for people who are not technical, completed between tasks instead of in a conference room.
Employees who report a suspicious message get recognized, not scolded. That positive approach is what turns people into the ones who catch the next scam.
Trusted by Montana organizations for over two decades
Clark Fork Valley Hospital
The hospital rolled out Granite’s Cybersecurity Awareness Training alongside its phone system upgrade, building a staff that is informed and alert to cyber threats.
Healthcare teams handle exactly the data attackers want, which makes trained, alert staff one of the strongest protections a clinic or hospital can have.
Read the Clark Fork Valley Hospital storySecurity awareness training questions
Security awareness training is a structured program that teaches employees to recognize and respond to threats aimed at people, such as phishing emails, spoofed senders, fake invoices, and social engineering calls. It combines short lessons, simulated phishing tests, and clear reporting steps. The goal is a team that pauses, checks, and reports instead of clicking.
New hires should get a security orientation before they handle sensitive information, and everyone should complete role-based training at least once a year. Granite Tech adds 10-minute quarterly micro-trainings and periodic phishing simulations in between, because threats change faster than an annual course can keep up with.
Very little. Quarterly micro-trainings take about 10 minutes, and the role-based modules are short enough to finish between tasks. The content is written for non-technical staff, so nobody needs a long session to follow it.
Often, yes. Insurers increasingly ask whether you run documented, regular employee training, and healthcare, financial services, and businesses handling payment data are commonly required to show it. Our security awareness training tracks completion, quiz scores, and simulation results, so you have records to show when asked.
Yes. Granite Tech has offices in Missoula, Bozeman, and Kalispell and supports businesses throughout Montana. Lessons and simulations are delivered to your team where they already work, and a local Granite Tech team member is a phone call away at 406-505-5061.
Find out how your team would handle the next phishing email
Request a short discovery call. We will talk through your team, your roles, and any insurance or compliance requirements, then follow up with a written proposal if there is a fit. If you don’t need it, we’ll tell you.
Or email CustomerCare@granite.tech