Cyber security onboarding that builds better new starter habits from day one
New starters are the most receptive audience in your organisation. They haven't formed habits yet.
Our cyber security onboarding puts new employees inside realistic security challenges. They practice spotting threats, questioning odd requests and making security decisions before bad habits settle in. The first 90 days shape everything, so why spend them on another forgettable compliance module?
Why cyber security matters during new starter onboarding
New starters go through more structured learning in their first few weeks than at almost any other point in their career. That's why cyber security needs a place in your onboarding.
They're learning who to trust, how things work and what's expected of them, and their security habits are forming alongside everything else. Do they know how to challenge a suspicious request? Will they feel comfortable questioning someone who sounds senior? Those are the behaviours worth getting right from the start.
Onboarding should show people what good security behaviour looks like in practice: situations to work through, decisions to make and somewhere safe to get it wrong. What they experience in week one shapes how they approach security long after induction is over.
Most organisations invest heavily in induction. Security gets a 20-minute module and a signature. That's a missed opportunity.
Cyber security risks for new starters
A new starter's risk isn't only about habits. It's about the social conditions attackers can exploit.
Someone new doesn't know everyone's voice, hasn't learnt every process and may not know who has authority over what. And when you're trying to make a good impression, challenging someone can feel like the last thing you want to do.
They don't know
anyone's voice yet.
A call from “IT support” or “the CFO's EA” in week one carries authority the new starter has no way to check.
They want to
be helpful.
Saying no to someone senior in the first week of a new job feels professionally risky. Attackers know this and use it.
They don't know
the procedures yet.
Even if they want to check, they may not know how. The challenge behaviour that protects experienced colleagues hasn't been built yet.
They have new accounts
and fresh access.
New logins, new system access and freshly issued credentials are an obvious target in the first weeks of employment.
A 90-day cyber security onboarding programme
Our 90-day approach introduces cyber security early, reinforces it as people settle in and checks how they respond to realistic situations. Here's one way it could work. The timing, activities and format all adapt to your existing induction.
Bring your new starters together for ESC, our physical cyber security escape room. They work through cyber-themed challenges as a group, solving problems, making decisions and getting to know each other along the way. It's a shared experience they can refer back to, not another module everyone completes alone.
Follow up with SHIFT, a browser-based digital cyber escape room new starters can play on their own, when it suits them. It reinforces the themes from induction and reaches anyone who missed the physical session.
Once new starters are settled but still in the early window, run CTRL+VISH. AI-powered voice phishing simulations put them on the receiving end of realistic social engineering calls. The results show who needs follow-up support and where to focus next.
Three products. One onboarding programme.
Each product has its own job in the 90-day window. None of them need new starters to know anything about security first, and all of them are built to be engaging rather than obligatory.
| Experience | What it does in onboarding | What new starters practice |
|---|---|---|
| ESC Physical escape rooms | Introduces cyber security through a memorable group experience, building a shared understanding from day one. | Working through cyber-themed scenarios, discussing decisions and solving security challenges as a group. |
| SHIFT Virtual escape rooms | Reinforces early learning with flexible digital play, including for anyone who missed the induction session. | Recognising threats and making security decisions in browser-based challenges they play on their own. |
| CTRL+VISH AI vishing simulations | Checks whether the first 60 days have landed: how new starters handle realistic scam calls, and where more support would help. | Recognising social engineering, challenging requests, checking who's calling and responding under pressure. |
How cyber security onboarding fits your existing induction
You've already got an induction programme. We're not here to tear it up.
Running a group induction? Start with ESC. Got remote starters joining throughout the month? SHIFT gives them a browser-based option. Want to revisit social engineering once people have settled in? Bring in CTRL+VISH.
It can be a single experience or a series of touchpoints across the first 90 days. You decide what fits, and we'll help make the security part worth paying attention to.
Security culture starts on day one, or it starts wrong
Culture isn't built in training sessions. It's built in the spaces between them.
What new starters see, hear and experience in their first few weeks becomes their idea of normal. If their security training is a module to click through, that's what security feels like where they work. If it's a high-energy team experience people are still talking about at the end of the week, that's a very different starting point.
The cohort effect
Running ESC with an induction cohort, rather than one person at a time, gives them something a solo digital experience can't: a shared memory. The people who went through it together have a reference point that lives on in conversation. When something feels off six months later, the instinct that fires is tied to a real experience with real colleagues.
Will one escape room change everyone's behaviour for ever? Of course not. But it gives your wider security awareness programme a far more engaging starting point.
What champions inherit
New starters who go through an immersive induction can make strong candidates for your security champions programme later. They've seen what good security engagement looks like, they share the language, and they know security training can be something people want to take part in.
What should cyber security onboarding include for new starters?
Phishing, password security, data handling and how to report something. Don't stop at the theory, though. Give new starters realistic scenarios where they can practice making security decisions.
When should new employees get cyber security training?
Cyber security training should start during induction and be reinforced through the first few months. Our 90-day approach builds security habits with immersive challenges, digital experiences and realistic simulations.
How can we make new starter cyber security training engaging?
Ditch the endless slides. Our cyber escape rooms and AI vishing simulations get new starters solving problems, making decisions and practicing security behaviours instead of sitting through another presentation.
Can cyber security onboarding work for remote or hybrid employees?
Yes. SHIFT and CTRL+VISH let remote employees practice security decisions without being in the room. Combine them with a physical escape room for a flexible onboarding programme.
How do you know whether new starter training has landed?
Look at what people do, not just completion scores. CTRL+VISH records how employees respond to simulated scam calls, showing where they might need more practice or support.
Can this programme fit our existing induction?
Yes. We work around your induction schedule, numbers and security priorities. Choose a single experience or spread them across 90 days, without rebuilding your onboarding.
Start the culture conversation on day one.
Planning cyber security training for your next intake? Tell us about your onboarding programme and we'll show you how to build security in from the start, not bolt it on at the end.