Cybersecurity awareness for new hires: how to do it with high turnover

By Kike Gandia · Co-Founder & CEO, OSCP · Last updated: November 2026

New starters are the weakest point of almost any awareness program: they arrive after the annual training has passed, they do not know the internal processes and they receive dozens of emails from departments they cannot yet tell apart. In companies with high turnover the problem multiplies, because there is always part of the workforce that has never seen a test phishing email. This guide explains what to do from day one and how to automate it so nobody is left out.

Why newcomers are the easiest target

A new employee expects emails from IT asking them to set up their account, from HR with documents to sign and from colleagues they do not know. That is exactly the kind of message an attacker imitates. They also do not yet know whom to tell if something looks odd, or what a legitimate email from their own company sounds like.

Attackers know this: recently published profiles on professional networks and changing org charts are useful information for preparing a believable lure.

The high-turnover problem

With one awareness session a year, whoever joins in February spends ten months without training. If turnover is high in areas such as customer service, logistics or sales, at any given time a large share of the workforce has never received a campaign or a course.

The solution is not to multiply in-person sessions, but to make awareness continuous and have joining the company trigger enrolment in the program automatically.

What to do on day one

Whom to tell: the specific channel for reporting a suspicious email and the contact person. It is the most useful thing a newcomer can take away.
What legitimate emails look like: which departments will write to them and through which channel real IT or HR notices arrive.
Secure access: turn on two-factor authentication from the first login and do not reuse passwords.
Basic rules: what can be installed, what data can be shared and how to use corporate tools.

It does not need to be a long talk: a few well-explained minutes at onboarding are worth more than a manual nobody reads.

The first weeks: joining the simulations

We recommend new starters join the simulation campaigns in their first weeks, when the risk is highest. If they fall for it, they immediately see which warning sign they should have spotted and get a short course; if they do not complete it, they get reminders. That way they learn from a real case in their own inbox, which sticks far better than a slide.

Contractors and associates count too

If someone has a corporate mailbox, they receive real phishing, whether they are an employee, contractor, intern or associate. Leaving them out of the program because they are not on the payroll leaves a door open. The practical rule is simple: whoever has a company mailbox is in the program.

Automate it: let onboarding trigger the program

The only way it works with high turnover is if nobody has to remember. If the simulation platform is synced with the company directory (Entra ID, in Office 365), every new account joins the campaigns automatically. That is how our phishing simulation platform works: it enrolls new hires automatically, assigns micro-courses to anyone who clicks and sends reminders to those who do not complete them.

And the flip side: when someone leaves, their account should be disabled the same day. A former employee's account that is still active is one of an attacker's favourite ways in.

FAQ

When should a new employee get their first simulation?

In their first weeks, after onboarding. It is when they receive the most unexpected emails and know the internal processes least, so it is when practice is most useful.

Should interns, contractors and external staff be included?

If they have a corporate mailbox, yes. They receive the same phishing as everyone else, and their account gives an attacker the same access.

How do I know new starters have completed the training?

With a platform that records which courses have been assigned and completed, and sends reminders to those with pending ones. That record also serves as evidence for an auditor.

Does it count as evidence for ISO 27001 or the ENS?

Yes. ISO 27001 includes information security awareness, education and training among its controls (A.6.3 in the 2022 version), and Spain's ENS covers it in measure mp.per.3. A record of campaigns and completed training per user is the kind of evidence an auditor asks for.

Sources

Automate awareness for new hires