I had one of those exceptionally bad IT days. An executive handed me a laptop with every major browser hijacked, plus a couple of questionable extra browsers and plenty of spamware. I explained the usual rules: don't install software without checking first, avoid suspicious websites, and never approve unexpected permission requests. He insisted he hadn't clicked any security pop-ups, but the browser settings showed that permissions had been granted manually.
After restoring that machine, I went home and had to clean similar junk from my elderly mother's computer. She was more focused on insisting she hadn't done anything wrong than on understanding how it happened.
So I'm wondering: can people actually be trained to recognize and avoid this stuff, or is security awareness mostly a losing battle? I know the obvious answer is to remove local administrator access and lock down the systems, but the executive's workplace won't allow those controls. This is a small business without a formal IT leadership or HR structure, so enterprise policies aren't realistic there. For my mother's computer, though, I'm considering much tighter restrictions and simpler safeguards.
5 Answers
The strongest fix is technical: standard user accounts, no local admin rights, application allowlisting, managed browser settings, ad blocking, web filtering, and strong endpoint protection. Some software installs into a user's profile without administrator access, so application control may be needed as well. Backups and network segmentation are important because prevention will never be perfect.
If management refuses to implement safeguards, that's a business risk decision, not an IT training failure. Document the recommendations and the risks that were accepted. You can keep reminding people, but you can't compensate for leadership deliberately leaving systems exposed.
Training helps some people, but it shouldn't be your primary defense. Users will eventually click something convincing, especially when they're rushed or an alert is designed to scare them. Use short, repeated reminders and teach a simple reflex: unexpected download, permission request, or urgent message means stop and ask first.
Making the training practical helps too. Showing a few real examples and explaining what to do next tends to work better than one long annual lecture.
For a family computer, simplify everything: remove administrator access, keep the operating system and browser updated, block browser notifications, use reputable filtering and security software, and make it clear that unexpected pop-ups are never support instructions. The goal isn't to make someone perfect at cybersecurity; it's to make the dangerous actions difficult or impossible.
Simulated phishing campaigns can improve behavior when they're regular and followed by quick, relevant training. People often become better at reporting suspicious messages once they practice it repeatedly. Keep the lessons focused on recognizing urgency, mismatched domains, unexpected attachments, and fake login pages rather than expecting users to identify every sophisticated attack.
Exactly. Users should be trained, but not trusted with enough access to turn one mistake into a company-wide incident.