Late summer and early autumn bring a wave of new starters, from graduates beginning their careers to experienced hires joining before the year-end push. It’s an exciting time. It’s also a risky one.
New employees don’t yet know what normal looks like. They don’t recognise colleagues’ writing styles, they don’t know which requests are routine, and they’re keen to make a good impression. Attackers exploit all of that.
Why new starters are targeted
It’s increasingly common for new employees to receive a convincing message within days of announcing their new role online. Typically it appears to come from a senior leader: “Welcome aboard! I need a quick favour before my next meeting. Can you pick up some gift cards for a client?”
It works because the new starter has no reason to doubt it, and every reason to want to help.
Getting the basics right before day one
Secure onboarding starts before the new person arrives.
- Provision access deliberately. Give people the access their role needs, not a copy of whatever their predecessor had.
- Enrol them in multi-factor authentication on day one, before they start using email and business systems.
- Issue managed devices with security tools, encryption and updates already in place.
- Share the reporting route early. Every new starter should know how to report something suspicious before they need to.
Make security part of the welcome, not a lecture
Security training is often squeezed into a long induction day alongside fire drills and expenses policies. Little of it sticks.
Instead, keep the first session short and practical. Cover:
- How to recognise phishing, including messages that impersonate senior colleagues.
- How the organisation handles payment and data requests, and why verification matters.
- What to do if they click something they shouldn’t have, and the reassurance that reporting quickly is always the right move.
Then follow up with short, regular refreshers over their first few months.
Tell people what you’ll never ask
One of the simplest defences is a clear statement of what the organisation will never do. For example: “We will never ask you to buy gift cards, share your password or change supplier bank details by email.” Give new starters this list in writing. It gives them permission to say no.
Don’t forget the leavers
Onboarding has a mirror image. When people move roles or leave, their access must change too. Accounts that stay active after someone leaves are a common route in for attackers. Build a simple joiners, movers and leavers process and check it regularly.
A security checklist for a new starter’s first week
Use this as a simple guide for line managers and IT.
Before day one
- Account created with role-based access, nothing more.
- Managed device prepared with encryption, updates and security tools.
- Multi-factor authentication ready to enrol on arrival.
Day one
- Short, practical security briefing, including how to report concerns.
- Written list of things the organisation will never ask them to do by email.
- Introduction to the people they’ll work with most, so impersonation is easier to spot.
First week
- First short training module completed.
- Questions answered about anything that felt unusual.
First three months
- Regular short refreshers and a first phishing simulation, with supportive feedback.
- Access reviewed once their role has settled.
Remote and hybrid starters need a little extra thought. Make sure devices are delivered securely, that they can reach IT easily and that they’re introduced to colleagues over video early on. People who have never met their team in person are particularly vulnerable to messages that claim to come from a manager they’ve only seen in an email signature.
Start strong
The habits people form in their first weeks tend to last. CyberQ’s Cyber Awareness Training gives new and existing staff short, engaging modules that build real-world instincts, with reporting that shows you how your team is progressing. Get in touch to build security into your onboarding.
