Technical protection doesn't stop everything — an email that gets past the filter ends up relying on a person's attention. Awareness training teaches employees to spot suspicious messages and know whom to tell.
Short, regular formats work best: simple tips, real examples and phishing simulations. The key message is "if you make a mistake, tell IT immediately" rather than hiding it.
Example
A test phishing email was sent around the office; anyone who clicked received a short guide on how to recognise such emails.