It’s tempting to assume that younger employees need less help with technology. After all, many have spent years using smartphones, social media and digital apps. But being confident with technology doesn’t necessarily mean knowing how to stay safe online.
For businesses, that distinction matters.
Digital confidence doesn’t equal cyber security awareness
Someone might be perfectly comfortable switching between apps, managing multiple devices and solving everyday technical problems. Yet they could still struggle to recognise a convincing phishing email, identify a fake login page or understand the dangers of reusing passwords.
These are very different skills, and confusing the two can leave businesses exposed.
I’ve seen organisations make assumptions about who needs cyber security training based on age or perceived technical ability. Employees who appear confident with technology are sometimes expected to know how to protect themselves without much guidance.
That approach can leave important gaps in a business’s defences.
Cyber security knowledge varies from person to person. One employee might spot suspicious emails immediately but use weak passwords across several accounts. Another might follow good password practices but approve an unexpected sign-in request without checking whether it is genuine.
Everyone has different strengths and weaknesses, which is why cyber security awareness needs to involve the whole team.
Cyber criminals target behaviour, not age
Cyber criminals are interested in finding the easiest way into a business. That might involve a deceptive email, a stolen password or an employee being persuaded to approve an access request.
Age and general technical confidence offer little protection against these tactics.
Even experienced employees can make mistakes, particularly when they are busy, distracted or under pressure to respond quickly. A convincing message that appears to come from a colleague, supplier or familiar service can catch almost anyone off guard.
Regular cyber security training helps employees recognise these warning signs and understand when to pause before taking action.
It also reinforces a simple principle: if something feels unexpected or unusual, checking it first is always better than assuming it is safe.
Modern working habits create new risks
The way people work has changed considerably. Employees are no longer accessing business systems exclusively from an office computer.
They might check emails on a mobile phone while travelling, approve sign-in requests between meetings, open work documents on different devices or move between personal and business applications throughout the day.
These habits can make working more flexible, but they also create additional opportunities for mistakes.
For example, an employee rushing to join a meeting might approve a sign-in notification without checking whether they initiated it. Someone working on their phone might overlook details in a suspicious email that would be easier to spot on a larger screen.
Effective cyber security awareness training should reflect how employees actually work, rather than focusing only on traditional office-based threats.
Practical examples help people recognise risks in everyday situations and make safer decisions when it matters.
Build a culture where people feel comfortable asking questions
Training should do more than teach employees what to look out for. It should encourage them to speak up when something does not seem right.
If someone receives an unexpected email, encounters an unfamiliar login request or suspects they have clicked something they should not have, they need to know what to do next.
Just as importantly, they should feel comfortable reporting the situation without worrying about being blamed for making a mistake.
Early reporting can give a business a better chance of responding before a minor incident develops into a more serious security problem.
Creating this kind of culture takes ongoing communication, clear reporting procedures and regular opportunities for employees to refresh their knowledge.
Make cyber security a shared responsibility
Protecting a business is not simply the responsibility of the IT team. Every employee who uses email, accesses business systems or handles company information has a role to play.
That means providing training for everyone, regardless of age, job title or apparent technical ability.
Regular awareness sessions, realistic examples and straightforward guidance can help employees develop safer habits and recognise threats before they cause harm.
The aim is not to make people afraid of technology. It is to help them use it confidently, while understanding the risks and knowing when to ask for support.
Is your team confident about staying safe online?
If your employees have not received cyber security awareness training recently, or you are relying on them to work out the risks for themselves, it may be time to review your approach.
At Affinity IT Services, we can help your business strengthen its cyber security awareness and build safer working habits across the team.
Get in touch with Affinity IT Services to discuss how we can help your people and your business stay safer online.
