Cybersecurity Awareness for Employees Course: Lessons 2026

Lesson 1: Why cybersecurity matters at work

Many attacks on workplaces start with a person who clicks a link, answers a call or opens a file. That is why cybersecurity is part of every job, not only the IT team's.

What the threats look like in Canada

The Canadian Centre for Cyber Security (the Cyber Centre) publishes a National Cyber Threat Assessment. The 2025-2026 edition says fraud and scams are almost certainly the most common form of cybercrime affecting Canadians, and phishing is one of the most reported types of fraud. It also says ransomware will almost certainly remain the most impactful (most damaging) cyber threat facing Canadian organizations.

Criminals also sell attack tools and stolen data to each other (cybercrime-as-a-service), so even unskilled criminals can attack. AI makes their messages more convincing, and deepfakes (fake AI-made audio, video or images) and voice cloning let them pose as people you trust.

Social engineering

Social engineering means tricking or pressuring people into giving away information or access, or into doing something harmful. Common tricks include:

• Phishing: fake messages that pretend to come from someone you trust (Lesson 2).
• Pretexting: a made-up story or role, such as "I'm calling from IT", used to gain your trust.
• Baiting: a tempting prize or reward used to get you to click or act.
• Business email compromise: pretending to be a leader, coworker or partner to ask for money or data (Lesson 3).
• MFA fatigue: sending sign-in approval requests again and again until you give in (Lesson 4).

Scammers use urgency, authority and fear so that you act before you stop to check.

Malware and ransomware

Malware is malicious software, such as viruses, worms, Trojan horses, spyware and adware. Malicious emails are often used to steal sign-in details, spread malware and steal or damage information.

Ransomware is malware that locks systems or data until a payment is made. Today, attackers often also steal data and threaten to leak it. Ransomware often gets in when someone opens a malicious attachment or link, or responds to a phishing message. Once one device is infected, it can spread to other systems on the same network.

Who gets targeted

The Cyber Centre says "no one is immune." Common targets include executives and their assistants, helpdesk staff, system administrators and staff who deal with the public. Ransomware attackers usually pick victims by opportunity, not by industry, so small workplaces are at risk too.

Temaquiz 1: Why cybersecurity matters at work

Lesson 2: Spotting phishing in email, texts, calls and QR codes

Phishing messages pretend to come from someone you trust, such as a bank, a courier, the government, your IT team or your boss. They try to get you to share information, click a link, open an attachment or send money.

Warning signs

• Urgency or threats: "within 2 hours", "your account will be closed".
• A request for personal or confidential information, or to sign in through a link.
• An offer that seems too good to be true, such as a refund or a prize.
• Unexpected attachments, links, QR codes or sign-in pages.
• A sender address that is misspelled or does not match the real organization.
• Generic greetings or poor grammar. But AI can write perfect messages, so good grammar proves nothing.
• Attachments with strange names or two file extensions, such as "Invoice.pdf.exe".

A known sender is not automatically safe. Email addresses can be spoofed (faked), and attackers use stolen accounts to phish the victim's contacts.

Check the link

Before you click, hover over a link to see the real web address. Look for small misspellings (typosquatting) and misleading subdomains, where a trusted name starts a long address that belongs to someone else. Logos can be copied. When in doubt, type the web address yourself or use a bookmark.

Texts (smishing)

Scam texts often say a parcel is on hold or a refund is waiting. Get Cyber Safe advises:

• Do not tap links in suspicious texts.
• Do not reply, even with "STOP". A reply shows your number is active.
• Forward it to 7726 (SPAM on most keypads) so your phone provider can investigate and block it. Then delete it.
• If unsure, contact the organization using the number on its official website.

Phone calls (vishing)

Caller ID can be spoofed to show your bank's name or an internal extension. AI voice cloning can copy a familiar voice. Scammers ask for passwords, PINs, one-time codes, banking details or remote access to your computer.

Hang up and call back using a number you already trust, such as the one on your bank card, the official website or your work directory. Do not use a number the caller gives you.

QR codes (quishing)

• Do not scan QR codes in unexpected emails or texts.
• A sticker placed over another code is a warning sign. Ask staff to check it.
• If a page asks you to sign in after scanning, check the web address carefully.
• Typing the web address yourself is safer than scanning.

Temaquiz 2: Spotting phishing: email, text, phone and QR codes

Lesson 3: Payment fraud, fake invoices and CEO scams

Some costly scams target people who handle money. In business email compromise, a criminal pretends to be a leader, coworker, client or supplier. The Canadian Anti-Fraud Centre (CAFC) describes several versions:

These messages may come from a spoofed address, a look-alike domain (kestrel-paving.example instead of kestrelpaving.example) or a real account that was taken over. Attackers can even hijack a real email thread. Spear phishing aimed at senior executives is called whaling.

Warning signs

• An unusual request from a boss or known contact.
• Urgency or secrecy (the RCMP lists both as warning signs): "keep this between us", "I'm offsite and can't take calls".
• Requests to buy gift cards or activate prepaid cards.
• Large or urgent wire transfers, especially to foreign accounts.
• Any change to banking or direct deposit details.
• An excuse for why the normal process cannot be used.

Verify before you pay

1. Stop. Do not reply to the message or use any phone number or link in it.
2. Find the person's contact details in your work directory or your own records, and call or speak to them to confirm.
3. Follow your organization's approval process for payments and banking changes, even when a senior leader says it is urgent.
4. If it was a scam, report it to your IT or security team and your manager.

The CAFC says to treat any request to change payment or banking details as suspicious until it is verified. A familiar voice on the phone is not proof either, because scammers can clone voices. Use a known number or an agreed call-back procedure.

False billing

In false billing, a business gets an invoice for something it never ordered. In the directory version, a caller asks staff to "confirm" the company's address and phone number, then sends an invoice for a directory listing. In the office supplies version, unordered supplies arrive with an invoice.

The CAFC suggests warning all staff about unsolicited calls and letting only a small number of staff approve payments. For unordered supplies, ask the sender in writing for proof of the order.

Temaquiz 3: Payment fraud, fake invoices and CEO scams

Lesson 4: Passwords, passphrases and multi-factor authentication

Criminals get passwords through phishing, by guessing common ones, and by trying passwords stolen in other breaches.

Passphrases and passwords

A passphrase is a set of random words, such as "copper lantern drifts west". It is longer than a typical password but easier to remember. The Cyber Centre recommends a passphrase of at least 4 words and at least 15 characters.

If a system does not allow a passphrase, use a password of at least 12 characters that mixes upper- and lower-case letters, numbers and symbols. To make it memorable, you can use the first letters of a sentence you will remember, plus numbers and symbols.

Avoid:

• Easy guesses such as "password" or "1234", even with letters swapped for symbols.
• Personal details such as a pet's name, a family member's birthday or your home town.
• Default passwords that come with a device or system.
• Reusing a password. If one account is breached, criminals may get into your other accounts too.

Never share your password, even with a coworker, and never reply to a message that asks for it. Do not keep passwords on a sticky note near your computer.

Password managers

A password manager is a protected vault that stores your passwords and can create strong ones. Protect it with a strong master passphrase and multi-factor authentication. Get Cyber Safe advises memorizing your most sensitive passwords, such as email and banking, instead of storing them. At work, use only tools your organization approves.

Multi-factor authentication (MFA)

MFA means signing in with two or more different kinds of proof, called factors, so a stolen password alone is not enough.

True MFA uses different kinds of factors. A password plus a security question is two things you know. Turn on MFA wherever it is offered.

Unexpected sign-in requests

An attacker who already has your password may send approval requests again and again, hoping you tap "approve" just to make them stop. This is called MFA fatigue. Some systems use number matching, where you type a number shown on the sign-in screen, to help stop it.

If you get a sign-in request you did not start: deny it, report it to your IT or security team right away, and change your password as they direct.

Temaquiz 4: Passwords, passphrases and multi-factor authentication

Lesson 5: Protecting workplace information and devices

Personal information and privacy law

Canada's federal private-sector privacy law is the Personal Information Protection and Electronic Documents Act (PIPEDA). It applies to private-sector organizations that collect, use or disclose personal information in commercial activity. Alberta, British Columbia and Quebec have their own private-sector privacy laws that are considered substantially similar.

Personal information is information about an identifiable person, such as a name, age, ID numbers, income, opinions, evaluations, disciplinary actions and employee files. Health and financial information are generally treated as sensitive and need stronger protection.

PIPEDA requires organizations to protect personal information with safeguards that fit how sensitive it is:

Everyday habits

• Need to know: open only the records you need for your job. Looking up a friend or neighbour out of curiosity is employee snooping, even if you tell no one.
• Lock your screen whenever you step away from your computer.
• Keep papers with personal information locked away, not left on desks or printers.
• Dispose of information securely: shred paper, and give old computers, phones and USB drives to IT so the data can be wiped or destroyed. Never put personal information in the regular garbage or recycling.
• Keep only the information you need on laptops and phones, and use auto-lock and encryption.

Devices away from the office

• Never leave laptops or phones unattended in public places or in vehicles.
• Public Wi-Fi: anyone can join, including criminals. They may set up an "evil twin" network with a similar name, so confirm the network name with staff.
• Do not send personal or financial information on public Wi-Fi unless you use a VPN your organization approves.

USB keys and other devices

Only connect devices that are known and trusted. The Cyber Centre warns that free devices from unknown sources, such as giveaways at trade shows, may contain malware. If you find a USB key, do not plug it in to see who owns it. Give it to your IT or security team.

Updates and backups

Updates often include security patches that close holes malware can use. Install them as soon as possible, or when your IT team schedules them. Devices and software that the maker no longer supports (end-of-life) stop getting updates and should be replaced.

Backups let you recover from hardware failure, ransomware, theft or disaster. The Cyber Centre's 3-2-1 rule: keep 3 copies of your information on 2 types of media, with 1 copy offsite. Keep at least one backup offline, because ransomware can reach backups on the network. Test backups regularly.

Temaquiz 5: Protecting workplace information and devices

Lesson 6: Reporting incidents and what to do if you clicked

Everyone makes mistakes. What matters is reporting quickly, so your IT or security team can limit the damage. At work, your organization decides who reports to outside agencies; your job is to tell IT or security, and your manager, right away.

The Cyber Centre defines a cyber incident as any unauthorized attempt, whether successful or not, to access, change, delete, block or shut down a computer system, network or account. A failed attack still counts.

If you get a suspicious message

• Do not reply, click or open anything.
• Keep the message for investigation and report it to your IT or security team using your organization's process.
• Do not forward it to coworkers.

If you clicked, opened or shared

Follow your organization's process. The Cyber Centre's general steps include:

1. Stay calm and stop using the device.
2. Disconnect from the network (turn off Wi-Fi or unplug the network cable) so malware cannot spread or reach the internet.
3. Contact your IT or security team right away and follow their instructions, including whether to shut the device down.
4. Change your password and reset MFA as your IT team directs.
5. If you shared banking or card details, contact your bank or card company.
6. Watch your accounts for unusual activity.

If a ransom message appears, disconnect the device from the network and report it at once. Do not pay or contact the attacker. Paying does not guarantee you get your data back, and attackers may still leak it or demand more.

Reporting fraud

• The Canadian Anti-Fraud Centre (CAFC) collects reports of fraud and cybercrime. Report online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501. The CAFC asks for reports even if you were not a victim.
• Fraud victims should also contact their local police and get a file number. If you are in immediate danger, call 911.
• Forward scam texts to 7726.
• Beware of offers to "recover" lost money for a fee. Fraudsters often target victims again.
• When you report a scam call, note the caller's number and any websites they asked you to visit.

Privacy breaches

Losing personal information or sending it to the wrong person is a privacy breach. Under PIPEDA, an organization must report a breach to the Office of the Privacy Commissioner of Canada and notify the people affected when it creates a real risk of significant harm, such as identity theft or financial loss. It must keep a record of every breach for two years. Tell your supervisor or privacy contact right away.

Temaquiz 6: Reporting incidents and what to do if you clicked