Training your team

Picture Farhana, who runs trainings for the partner groups of a labour rights network in Dhaka. Her first was a two-hour talk on encryption. People nodded, thanked her and went back to sending passwords in chat. Now she runs short sessions every few weeks, each built around one habit and something to practise, and keeps a group chat open for questions in between.

What training is for

Tools protect people only once they can use them, and habits stick when people see why they matter. LevelUp, a set of training guides written by digital security trainers, puts it as a first rule: “Always explain why a tool, strategy, or habit is important before you start training on it” (LevelUp). Security is as much a change in habits as a choice of tools.

The session is the easy part. Too often, people attend a good training and then don’t use what they learned (LevelUp). One-off trainings seldom change habits for good, so what happens afterwards matters as much (Holistic Security).

Expect a wide range of skills in one room. A human rights defender in Kenya described it for a 2025 study:

Awareness and use of digital security tools among HRDs vary significantly, with some familiar with encrypted apps like Signal, while others face barriers such as lack of training, limited resources, language challenges, low bandwidth, and outdated devices.

A human rights defender in Kenya, in HURIDOCS’s study by Tomiwa Ilori

What works with busy colleagues

Small organisations that keep training going tend to mix a few formats:

• Short team sessions, spread over weeks rather than one long day (SAFETAG; Holistic Security).
• Games and tabletop exercises, where the team talks through an incident together. SIIRF’s Chips Down has four levels to work through.
• One-to-one follow-ups for anyone who needs more time or a quieter setting.
• A standing chat where anyone can ask a security question, about the policy or anything else, without waiting for the next session.

Use examples your colleagues will recognise from their own work, and learn how they already do things before you suggest changes (LevelUp).

A simple session shape

Adults learn best when they know why something matters, help shape what they learn and work on real problems they’ll meet the next day (LevelUp). LevelUp’s session shape follows that:

1. Start with an activity. A short exercise or a real example that gets people thinking.
2. Talk about it. What did people notice? What do they already do?
3. Add the key information. Only what the session needs, in plain words.
4. Practise. Hands-on, on people’s own phones and laptops where it’s safe to.
5. Sum up together. What will each person do differently this week?

Most guides in this handbook end with a short session you can run, built the same way.

Watch the worry level in the room

Too much worry stops people learning, and so does too little.

Too little anxiety and they will not be motivated to engage in the training or learn new skills, whereas too much anxiety and the fear buttons in their brains are pressed and the capacity to learn may be reduced.

Craig Higson-Smith, Center for Victims of Torture, for LevelUp

Aim for the middle, and adjust as you go. Someone who has just been hurt or is overwhelmed may be better off not joining a session about threats; offer them another way in, such as a one-to-one later (LevelUp). Start each session by checking in on how people are and what’s happening around them (Holistic Security). Well-being and care has more.

Keep the training itself safe, too: don’t post who attended (LevelUp), and tidy away notes and flip charts with sensitive details afterwards (Holistic Security).

Practise without tricks

Don’t send your colleagues fake phishing emails to see who clicks. A 15-month study of more than 14,000 employees found that training shown to people after they clicked a fake phishing email didn’t make them more resilient, and could even make them more likely to fall for phishing (ETH Zurich). Fake emails also breed anxiety and mistrust of real ones (Shira).

Practise with quizzes instead. Shira, made by the non-profit Horizontal, lets people spot fake messages across email, texts, chat apps and social media without being caught out, and has a free version. In the same study, run at a large company, employees reporting suspicious emails worked as a shared early warning (ETH Zurich). Make reporting easy, and thank everyone who does it.

Seeing what’s sinking in

• Ask, anonymously. A short survey where people rate themselves before and after (for example, “I know what to do if my account is taken over”) shows change without singling anyone out (SAFETAG).
• Follow up a few months later. What’s still being done, what got dropped, and what’s in the way (SAFETAG)?
• Watch the signs that matter. More reports of suspicious messages, two-factor switched on across accounts and quicker reporting after a click say more than a test score. Checklists and audits helps you track them.

Keeping it going

Regular contact beats one big event. Many groups bring in outside trainers (New America), and that helps most when someone inside keeps the habits going after the trainer leaves (Holistic Security). That someone is usually the security champion.

Make materials that work for your team: short enough for a phone, usable offline or on paper, and in the languages people work in. Defenders in HURIDOCS’s study asked for regular, hands-on training suited to different skill levels, and for tools that are affordable, work offline and come in local languages (HURIDOCS).

Where to go next

• Phishing: what to practise spotting.
• Your incident response plan: rehearse it with Chips Down.
• Checklists and audits: check what’s sticking.
• Security policies: the agreements you’re teaching.