Sensitive client and patient data. Payment instructions that change at the last minute. A packed inbox and a deadline that cannot wait.
For your firm, one convincing email can put credentials, confidential records, and funds at risk. A spam filter helps. So do endpoint security and ransomware protection. But your staff still need to know what to do when a message looks legitimate, and how to report it quickly when something feels wrong.
Phishing awareness training is not about blaming people for making mistakes. It is about building a practiced response before a real attacker puts your team under pressure.
Why phishing training is a practical and regulatory expectation
Phishing is a common route to stolen sign-in details. An attacker who gets a foothold in a real mailbox may use it to impersonate a partner, request a payment change, or access sensitive messages and files. That can lead to business email compromise, wire fraud, client confidentiality issues, exposure of protected health information, or ransomware.
Regulatory obligations depend on what your organization does and which rules apply. For covered financial institutions, the FTC Safeguards Rule requires personnel to receive security-awareness training updated as necessary to reflect risks identified in the firm’s risk assessment. The rule does not prescribe a particular training vendor or require phishing simulations. But where phishing is a foreseeable risk, teaching people to recognize and report it is a sensible part of a risk-based program.
Coverage is activity-specific. A business is not automatically covered by the FTC Safeguards Rule simply because it is an accounting firm or law firm. Firms should confirm their obligations with qualified counsel.
For HIPAA-regulated organizations, the Security Rule requires a security-awareness and training program for workforce members, including management. HHS guidance encourages ongoing training and security reminders that address current threats, including phishing. See the HIPAA Security Rule and HHS guidance on phishing.
Training is one safeguard, not a substitute for strong email security, MFA, managed devices, or a clear incident-response process. For more on the financial consequences of a compromised mailbox, see our earlier article on business email compromise affecting professional firms.
A realistic phishing awareness program: five building blocks
A useful program is consistent, relevant, and short enough to fit into a working day. It should teach a few clear actions, then reinforce them over time.
1. Start with a baseline, not a blame exercise
First, find out what staff already know and where your firm has risk. Review the results of your IT assessment, prior incidents, email-security controls, and the kinds of information and transactions your people handle.
A short baseline exercise can help identify patterns: Do employees report suspicious messages? Do they recognize unexpected sign-in prompts? Do they know how to verify payment instructions without relying on contact information in the email?
Set expectations clearly. A baseline is for improving the program, not embarrassing individuals. If you need a fresh view of your environment, an IT assessment for law firms, medical practices, and accounting firms can help connect training to broader risks.
2. Deliver brief, ongoing lessons
One long annual presentation is easy to forget. Short, periodic lessons are easier to absorb and reinforce.
Cover practical behaviors such as:
- Checking the sender’s actual address, not just the display name.
- Pausing before opening an unexpected link, attachment, QR code, or shared document.
- Never entering a password after following an unsolicited sign-in link.
- Treating unexpected MFA prompts as a warning, not an inconvenience to approve.
- Verifying sensitive payment or account-change requests through a known, separate channel.
- Reporting suspicious messages promptly, even if the employee already clicked.
Keep it concrete. “Be careful online” is not an instruction someone can reliably use when a message says, “I need this before court,” or “Please send the patient form again.”
3. Use simulations carefully, and use the results well
Simulated phishing can test whether lessons are landing. HHS identifies simulated phishing messages as one example of a security reminder. They are a useful tool, not a requirement expressly specified by either the FTC Safeguards Rule or HIPAA.
Choose scenarios that resemble your firm’s actual work. Track more than clicks: measure whether employees report the message, how quickly they report it, and whether repeat lessons improve recognition. If someone interacts with a test, follow up with brief, helpful coaching.
A simulation should never collect real passwords or patient or client information. Avoid “gotcha” tests that punish staff. A program that makes people afraid to admit a mistake can delay the very report you need.
4. Make reporting easy and safe
“Tell IT” only works if employees know exactly how. Give staff a simple reporting button, a dedicated mailbox, or a clear phone number, and explain which to use for an urgent incident.
Set a no-blame expectation: report the message, even if you clicked, replied, entered a password, or approved an unexpected prompt. The sooner your IT team knows, the sooner it can check the account and limit further damage.
This is where a reporting culture matters as much as a training module. If employees expect to be scolded, they may wait. If reporting is routine and appreciated, suspicious activity is more likely to reach the people who can act.
5. Include new hires from the beginning
New employees receive genuine welcome messages, account setup requests, payroll instructions, and shared documents. Attackers know the first days can be confusing.
Assign security training as part of onboarding, alongside account and device setup. Show new staff how to report suspicious email and unexpected MFA prompts before they begin handling sensitive information. Revisit the basics during the first week.
Tailor examples to the people and the work
A receptionist, associate, clinician, tax preparer, and managing partner do not face exactly the same risks. Give everyone a common foundation, then add relevant examples by role.
- Attorneys and firm principals: fake client or opposing-counsel requests, confidential-file sharing, trust-account or settlement-payment instructions, and messages impersonating a partner. People who can authorize or influence client-fund transfers need a clear verification process that does not depend on email alone.
- Medical staff and practice managers: fake patient-portal or referral messages, suspicious attachments, misdirected records, and requests involving protected health information. Staff should know who to contact if they suspect a message exposed PHI.
- Accounting staff and firm leadership: fake tax or payroll requests, W-2 and tax-return lures, invoice changes, and credential-harvesting messages, especially during busy filing periods.
- All employees: unexpected login pages, urgent requests to bypass normal procedures, and MFA prompts they did not initiate.
The familiar “Hey Margaret, can you take care of this right away?” may feel routine. That is precisely why training should pair recognition with a dependable verification step.
What evidence should your firm keep?
Training should be demonstrable, not just remembered. Keep records that let you show what your program covered, who participated, and how you acted on what you learned.
A practical evidence file may include:
- Your risk assessment and the training topics selected to address identified risks.
- The training materials or course version, dates delivered, and completion records.
- New-hire assignments and completion status.
- Simulation dates, outcomes, reporting rates, and follow-up actions.
- Security reminders, policy acknowledgments, and any relevant management review.
These are practical documentation measures; the FTC rule does not prescribe a particular training-record format. Your insurer, auditor, or regulator may ask different questions, so align records with your firm’s obligations and retention practices. Avoid keeping unnecessary sensitive information in training records.
Internal training or a managed program? The trade-offs
Your team can run training internally. That gives you control over examples and direct knowledge of staff roles. The trade-off: creating content, tracking completion, and keeping lessons current take time. Staff turnover can leave gaps, and “Hey Margaret, did everyone finish?” is not a repeatable process.
A managed IT provider can help schedule training, run simulations, track evidence, and connect lessons to email security, endpoint security, and incident response. You still need to approve the approach and make sure examples fit your firm. The right model depends on your capacity, risk, and need for predictable costs.
Final Word
Phishing awareness training is not a one-time video or a test of who clicks. It is a practical layer of defense: clear habits, safe reporting, role-specific examples, and records showing that your firm takes the risk seriously.
For law firm cybersecurity, HIPAA compliance, GLBA compliance, and businesses covered by FTC safeguards, that human layer belongs alongside technical controls and documented processes. A PC of Mind provides managed IT and cybersecurity support for professional firms that need reliable business IT support, not just a reminder to “be careful.”
This article is general information, not legal advice. Confirm your specific regulatory obligations with qualified counsel.
