How can experienced sysadmins improve their phishing awareness?

Make the process routine instead of trying to become suspicious of absolutely everything. For every unexpected message, pause and ask: Was I expecting this, does the request make sense, is the sender using the normal address, and can I confirm it independently? Security-awareness exercises are useful when they explain the specific clues you missed, so review the feedback from each failed simulation and build a short checklist around your recurring mistakes.

At this stage, repeatedly failing simulations is a real workplace risk, so treat the remedial training seriously rather than looking for a gimmick that will scare you into compliance. Ask your security team for examples of the patterns you are missing and practice analyzing them. If a message requests a login, payment, sensitive data, or an unusual change, stop and verify it before doing anything.

This may be less about age or a special training course and more about deliberately slowing down. Treat unexpected messages as untrusted until you verify them. Check the actual sender address, hover over links to inspect the destination, and avoid opening attachments you were not expecting. If something still feels unclear, verify it through a separate, trusted channel. With repetition, looking for those signals becomes automatic.

A useful mindset is “trust, but verify.” Experienced administrators sometimes explain unusual system behavior as a configuration mistake because that is often what it is. That instinct is reasonable during troubleshooting, but it should not carry over to messages asking for credentials, money, downloads, or urgent action. Handle those requests as security events first and ordinary business communication second.