Quick answer
Firewalls do not stop an employee who hands over access. Under the CERT-In Directions of 28 April 2022 (section 70B(6), IT Act, 2000), body corporates must report phishing, spoofing, unauthorised access and data breaches to CERT-In within six hours of noticing them. Role-based, scenario-led awareness training, refreshed quarterly, closes the human gap.
Key takeaways
- The most common security gap in Indian enterprises is people, not technology: a click, a call or a reused password.
- Phishing, spoofing and unauthorised access are reportable to CERT-In within six hours.
- Scenario-based training changes behaviour; a 40-page policy PDF does not.
- Layer training by role: finance, HR and technical teams face different threats.
- Run a phishing simulation first, then refresh quarterly rather than annually.
Vikram's company had invested lakh in technology security. They had invested nothing in training the people who used it.
This is the most common cybersecurity gap in Indian enterprises right now, and it's not a technology problem. It's a people problem. And people problems are solved with training, not firewalls.
Why is information security awareness training essential for Indian companies?
Because the most common security gap is people, not technology. A firewall cannot stop an employee who clicks a convincing link, shares a password or trusts a caller.
Globally, 95% of all cybersecurity breaches involve human error: according to IBM's Cost of a Data Breach Report. In India, the number of reported cyber incidents crossed 1.3 million in 2025, with phishing, social engineering, and credential theft leading the list.
Not system vulnerabilities. Not zero-day exploits. A person making a mistake that training could have prevented.
Yet most Indian companies treat information security awareness (ISA) training as an annual tick-box, a PDF policy document that gets emailed in January and promptly forgotten by February.
Meanwhile, attackers are running new phishing campaigns every week. The emails look more convincing every month. And your employees are clicking, forwarding, and trusting, because nobody has trained them to pause, question, and verify.
Which employee behaviours do attackers exploit most?
Three patterns recur: the fake CEO email, the fake IT support call and the reused password. It's rarely malice. It's almost always ignorance. Here are the three patterns that show up repeatedly in Indian enterprise breaches:
The "CEO Fraud" email. A convincing email appears to come from the MD or CFO, asking someone in accounts or HR to urgently transfer funds or share a file. The employee, not wanting to seem unhelpful to the boss, complies. The email was fake. The transfer was real.
The "IT Support" call. Someone phones the admin desk claiming to be from the company's IT vendor. They need the employee's credentials to "fix a system issue." The employee provides them. The credentials are used within minutes.
The shared password problem. An employee uses the same password for their corporate email and their personal social media account. The social media platform gets breached. The attacker now has corporate email access too.
⚠️ A question for your IT or HR team right now:
If someone called your front desk claiming to be from your IT vendor and asked for a user's password, would the employee know to refuse? Would they know who to report it to? Does your company have a tested protocol for this? If you're unsure, your employees are probably unsure too.
None of these scenarios required sophisticated hacking. All of them required employees who didn't know the right behaviors, because no one had taught them in a way that stuck.
Each of these patterns can also become a reportable incident. The CERT-In Directions list identity theft, spoofing and phishing attacks, unauthorised access to IT systems or data, and data breaches among the incidents that must be reported within six hours of being noticed. Employees are usually the first to notice, so they need to know the internal reporting route.
| Attack pattern | CERT-In Annexure I category | What the trained employee does |
|---|---|---|
| "CEO Fraud" email asking for an urgent transfer or file | Identity theft, spoofing and phishing attacks | Pauses, verifies on a known channel and reports it |
| "IT Support" call asking for credentials | Identity theft, spoofing and phishing attacks; unauthorised access of IT systems/data | Refuses to share the password and escalates |
| Corporate password reused on a breached personal account | Unauthorised access of IT systems/data | Uses unique passwords and reports a suspected compromise at once |
| Confidential file shared unsafely or on public Wi-Fi | Data breach; data leak | Follows data handling rules and reports the slip without delay |
What does good information security awareness training look like?
It is scenario-based, layered by role and repeated, so employees practise the decision before they face it for real.
The problem with most ISA training isn't the content, it's the format. Reading a 40-page security policy document does not change behavior. Watching a generic 20-minute global video about "cyber hygiene" does not build instincts.
What works is scenario-based training: showing employees exactly what a phishing email looks like, walking them through the decision they'd face in real time, and letting them experience the consequence of a wrong choice, safely, in a simulation, before it happens in real life.
Good ISA training also has to be layered by role. The threat landscape for an accounts executive is different from that of a developer. The risks for a remote worker are different from those of someone in a secure office environment. One-size-fits-all training misses too much.
"The goal of information security awareness training isn't to make every employee an expert. It's to make every employee a harder target."
What does the Compliance at Workplace ISA course cover?
The Information Security Awareness module on Compliance at Workplace is built for the Indian workplace context, covering the threats Indian employees actually face, in the language and formats that work for diverse workforces.
- Phishing recognition: real-vs-fake email walkthroughs, URL inspection, social engineering red flags
- Password hygiene: what strong looks like, password manager basics, what to do after a suspected breach
- Data handling: what's confidential, how to share it safely, what NOT to do on public Wi-Fi
- Incident reporting: how to escalate a suspected breach without panic, who to call, what not to touch
- Remote work security: VPN usage, home network risks, device management basics
Completion is tracked automatically. Certificates are generated per employee. And because the content is updated periodically to reflect new threat patterns, you're not training employees to recognize last year's attacks. For the full set of courses, see our information security training hub.
What can you do this month to strengthen your human security layer?
Run a phishing simulation, make the training role-specific and move to quarterly refreshers.
1. Run a phishing simulation before training. Send a controlled fake phishing email to your team (with IT's help) and see who clicks. The results will tell you exactly how urgent the training is, and give you a baseline to measure improvement against.
2. Make ISA training role-specific. Don't send everyone the same module. Finance teams, HR teams, and technical teams face different threats. Tailor the content, and completion rates will improve too.
3. Repeat quarterly, not annually. Threat patterns change fast. Your employees' memory fades faster. Short quarterly refreshers are far more effective than one long annual session, and take less time too.
Frequently asked questions
Is information security awareness training mandatory in India?
No Indian law names a specific course. However, the DPDP Act, 2023 (section 8(5)) requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches, and the CERT-In Directions require six-hour incident reporting, which only works if employees know how to recognise and escalate an incident.
Which incidents must be reported to CERT-In, and how fast?
Incidents listed in Annexure I of the CERT-In Directions of 28 April 2022 must be reported within six hours of noticing them. The list includes identity theft, spoofing and phishing attacks, unauthorised access of IT systems or data, data breaches and data leaks.
How often should we run security awareness training?
Short quarterly refreshers work better than one long annual session, because threat patterns change fast and employees forget faster.
Should finance, HR and IT teams get different training?
Yes. An accounts executive faces CEO fraud and payment scams, while a developer or remote worker faces different risks, so one-size-fits-all training misses too much.
How do we know if the training is working?
Run a controlled phishing simulation before training to set a baseline, then repeat it after training and compare. Track completion and certificates per employee.
Sources
Download the ISA Training Checklist for Indian Enterprises
A practical guide for HR and IT teams on what to cover, how to track, and how to build an annual awareness calendar that actually keeps employees safe.
Request Demo