# Information Security > Information security awareness training for staff handling customer data: phishing, passwords, safe devices, privacy, AI tools and incident reporting. - Source: https://bodhih.com/information-security/ - Publisher: Bodhih Training (Bengaluru, India; since 2008) - Last updated: 2026-10-15 - Contact: solutions@bodhih.com · +91 99000 11601 --- ## At a glance - **Duration:** 1-day · customisable - **Who it’s for:** This is a common program for all the employees who work in a IT environment and handling customer data is a part of their work profile. - **Format:** In person · Live virtual · Blended - **Where:** India & 7 regions worldwide - **Track record:** Since 2008 · 2,000+ companies Information security awareness training is a practical program that helps all employees protect company and customer data in everyday work. It covers phishing and social engineering, passwords and multi-factor authentication, safe device and network use, data privacy, secure use of AI tools and incident reporting. Bodhih runs it as a 1-day program customised to each organisation's policies. - Standard duration: 1-day, customisable to your needs - Delivered in person at your location or as live virtual sessions - Designed with the ADDIE model and evaluated for behaviour change - Offered by Bodhih since 2008 to 2,000+ organisations across 7 regions **Where and how:** information security training as an in-person workshop in [Bengaluru](https://bodhih.com/corporate-training-in-bangalore/), [Mumbai](https://bodhih.com/corporate-training-in-mumbai/), [Delhi NCR](https://bodhih.com/corporate-training-in-new-delhi/), [Gurugram](https://bodhih.com/corporate-training-in-gurugram/), [Hyderabad](https://bodhih.com/corporate-training-in-hyderabad/), [Chennai](https://bodhih.com/corporate-training-in-chennai/), [Pune](https://bodhih.com/corporate-training-in-pune/), [Kolkata](https://bodhih.com/corporate-training-in-kolkata/), [Ahmedabad](https://bodhih.com/corporate-training-in-ahmedabad/) and [Jaipur](https://bodhih.com/corporate-training-in-jaipur/); as a live online course; or delivered overseas in [Dubai](https://bodhih.com/corporate-training-in-dubai/), [Singapore](https://bodhih.com/corporate-training-in-singapore/) and across the Middle East, Asia and Africa. Last reviewed 15 Oct 2026 by [Siddharthan VGJ](https://bodhih.com/siddharthan-vgj/), Founder · Bodhih Training, Bengaluru Data Protection and Data Privacy ## Program Overview: - Securing your Endpoint Devices and Organization Networks - Data Theft Protection tips for Cellular Devices - Protecting Your Personal Identity - Protecting Your Online Transaction and Credit Information - Protecting Your Data on Social Networking - Secure While you Surf Data Online - Countermeasure Data Breach standing the MicroStrategy architecture. ### Training Duration: 1-day Instructor Led Training ### Target Audience: This is a common program for all the employees who work in a IT environment and handling customer data is a part of their work profile. ### Training Prerequisite: Basic Computer Knowledge. ## Training Outcome: - Practical Approach - Hands on training session - Real time project and case studies - 24/7 support #### Solutions & Services ## What participants will be able to do ### Recognise phishing and social engineering Participants spot suspicious emails, messages, calls and QR codes, including AI-generated scams. ### Protect accounts Employees use strong passphrases, password managers and multi-factor authentication correctly. ### Secure devices and connections Participants keep laptops and phones updated, locked and safe on public networks. ### Handle personal and customer data responsibly Employees apply data classification, minimisation and privacy principles in daily work. ### Use AI and cloud tools safely Participants know what information must not be pasted into public tools or shared through unapproved apps. ### Report incidents quickly Employees know what counts as an incident and exactly how to report it. ## Who should attend - All employees who handle customer or company data - Customer support, sales and operations teams working with personal information - New joiners as part of induction - Managers who must reinforce security behaviour in their teams - Remote and hybrid staff working from home or on the move ## Recommended program outline Recommended design, customised to your context after a short needs analysis. ### **Why information security matters**Module 1 · 1 hour - The CIA triad: confidentiality, integrity and availability - How attackers target people rather than systems - Individual responsibilities under company policy - Recent attack patterns explained in plain language ### **Phishing and social engineering**Module 2 · 1.5 hours - Email, SMS, voice and QR code phishing - Deepfakes and AI-generated impersonation scams - Hands-on exercise: spot the phish - What to do after clicking a suspicious link ### **Accounts, devices and networks**Module 3 · 1.5 hours - Passphrases, password managers and multi-factor authentication - Endpoint and mobile device security - Safe browsing, public Wi-Fi and VPN use - Physical security, clean desk and screen locking ### **Data protection and privacy**Module 4 · 1.5 hours - Data classification and handling rules - Privacy principles and data protection law in overview, such as India's DPDP Act - Protecting identity, transactions and data on social networks - Safe use of public AI tools, file sharing and USB drives ### **Incidents and everyday habits**Module 5 · 1.5 hours - Recognising a data breach or security incident - Reporting steps and first actions - Scenario walk-throughs and a personal security checklist - Quick quiz to confirm key learnings ## Sample training plan: 1-day hands-on design This one-day program makes security a daily habit for employees who handle customer and company data. Participants spend most of the day doing, not listening: they hunt for phishing clues in real-looking emails, texts and QR codes, crack weak passwords on a demo screen, set up multi-factor authentication on their own phones, classify sample documents, decide what can and cannot go into a public AI tool, and walk through an incident from the first suspicious click to the report. They leave with a personal security checklist. 72% hands-on practice · 6.8 contact hours · Cohort: 15–30 participants · In person · Live virtual ### Day 1: Security as an everyday habit Participants can spot, prevent and report the most common threats to people, devices and data in their daily work. 1. 09:30–10:00 · What is your data worth? (Energiser) 2. 10:00–10:45 · Confidentiality, integrity, availability (Concept burst) 3. 11:00–12:00 · Spot the phish (Group challenge) 4. 12:00–12:30 · I clicked. Now what? (Role-play) 5. 13:15–14:15 · Accounts and passwords lab (Hands-on lab) 6. 14:15–15:00 · Device and Wi-Fi check-up (Skill drill) 7. 15:15–16:00 · Data classification and AI tools (Case clinic) 8. 16:00–16:45 · Capstone: the breach walk-through (Simulation) 9. 16:45–17:30 · My security habits (Action planning) Recommended: 1 day in person (09:30–17:30), or 3 × 2-hour live virtual sessions, with a simulated phishing check at day 30 and short refreshers through the year. A sample design: every Bodhih program is customised after a short needs analysis. ### How long is information security awareness training? The recommended design is one day in person, 09:30 to 17:30, or three live virtual sessions of two hours. A shorter half-day version suits induction. A simulated phishing check at day 30 and short refreshers through the year keep the habits fresh. ### What activities are included in information security awareness training? Participants race to spot clues in 20 phishing messages, role-play the first ten minutes after a bad click, enable multi-factor authentication on their own accounts, classify 15 sample items including what can go into AI tools, and work through a timed breach simulation. ## When to choose this ✓**You need annual security awareness training for all staff**✓**Phishing tests or incidents show risky behaviour**✓**Your organisation handles regulated or sensitive customer data**✓**You are rolling out new policies or tools and need staff to understand them** ## Frequently asked questions ### What is information security awareness training? Information security awareness training teaches employees how to recognise and avoid common threats, protect accounts and devices, and handle data safely. Because many breaches start with human error or manipulation, it is a core part of any security program. Bodhih's one-day program is practical and scenario-based, and it is customised to your policies. ### How often should employees receive security awareness training? Most organisations run security awareness training at least once a year, with new joiners covered at induction. Short refreshers in between help, because threats such as phishing change quickly. Bodhih can pair the core program with shorter follow-up sessions or e-learning modules through Bodhih.org to keep the key messages fresh. ### Does the training cover India's data protection law? Yes, at an awareness level. The program explains the key ideas behind India's Digital Personal Data Protection Act, such as consent, purpose limitation and handling personal data responsibly. It is not legal advice, and it is aligned with your own policies. Teams in other regions can have examples from their applicable regulations instead. ### How do you train employees to recognise phishing? The most effective approach is practice. Participants examine realistic sample messages, identify warning signs such as urgency, mismatched links and unusual requests, and discuss what to do next. The program also covers phone, SMS, QR code and AI-generated scams. Clear reporting steps ensure people know how to act on a suspicious message. ### Is this program suitable for non-technical staff? Yes. It is designed for all employees, not IT specialists, and uses plain language and everyday examples. The only prerequisite is basic computer knowledge. Technical teams who need deeper security skills, such as secure coding or DevSecOps, can take a separate technical program customised for their roles.