Employee cybersecurity training is becoming an important best practice for organizations, and for good reason. In fact, more than half of small business owners name employee error as the biggest information security risk to their companies.

Many organizations hold annual security training for their employees, which is an important practice that should remain in place. That said, there’s great value in training new employees on cybersecurity during the onboarding process instead of waiting until an annual security training rolls around. While new employees bring skills and experience to the team, they could also bring significant risk if they were never properly educated on cybersecurity practices at previous jobs.

Including security training as part of the initial employee onboarding process makes it clear to new hires that they play a critical role in maintaining the company’s privacy and security, as well as protecting sensitive customer information. It also educates them on key cybersecurity principles, such as how to recognize and avoid common threats, the importance of strong passwords, and the risks of unsecured devices, such as their personal cell phone.

Since cybersecurity is such a broad topic, you might be wondering what to focus on when training your employees. Here are a few of the most important cybersecurity lessons to communicate to new employees as soon as they join the team.

1. Avoid phishing scams.

Phishing scams are a huge cybersecurity threat to companies, playing a role in 91 percent of all data breaches. That’s why it’s essential to teach new employees how to recognize and avoid possible phishing attacks. Be sure to educate them about spear phishing emails, which appear to come from a trustworthy sender but are actually designed to steal sensitive company data. These emails often come from someone high up at the organization, like the CEO.

Teach employees to be vigilant when checking their emails, and to be cautious if an email from a coworker contains lots of typos or asks for sensitive information. If they receive emails that seem suspicious, instruct them to verify the email address to make sure it originated from the actual sender. In addition, educate your new employees to hover their mouse over any links in emails to see where they will take them.

2. Keep up with security patches and software updates.

Another important lesson to teach your employees is to stay on top of security patches and software updates. While it’s easy to click the “update later button” on software update notifications, ignoring them can put devices – and your company – at risk. Security patches and updates are designed to repair vulnerabilities in your device or software and should be installed immediately. Instruct new employees to check their devices for software updates regularly and to install them right away.

3. Avoid unsecured Wi-Fi networks.

Be sure to educate your employees about the dangers of unsecured Wi-Fi networks and how to protect their devices when using public Wi-Fi. This is especially important if you let your employees work remotely or set up permissions so they can access work communications outside of the office. Your employees need to understand that bad actors often linger on unsecured public Wi-Fi networks, hoping to launch a man-in-the-middle attack and steal their sensitive information. If your employees want to connect to public Wi-Fi, make sure they use a virtual private network (VPN) to secure their connection and protect company data.

4. Stick to company-sponsored apps and tools.

During cybersecurity training, stress the importance of sticking to apps and online tools that are company-approved. If employees avoid using employer-mandated tools and opt for their preferred apps instead, they create risk by spreading sensitive company information on systems outside the company’s control. Teach new employees about the dangers of circumventing company-sponsored apps and provide in-depth training on approved tools so employees don’t feel the need to seek out alternatives.

5. Create strong passwords.

Communicating the importance of using strong passwords is an important step to secure sensitive company data. Creating a strong password by using a password generator or a password manager can help secure accounts and prevent cyberattacks. An important point to make with your employees is not only to focus on using strong passwords, but to ensure they are not using the same password on all of their logins.

Employee cybersecurity education is essential for companies of all sizes. In fact, employee cybersecurity training might be even more important for small businesses, which rarely have access to the resources and sophisticated IT teams that large corporations rely on to protect their organizations.

For this reason, small businesses need to take a proactive approach to educating new employees on cybersecurity best practices. By including cybersecurity training during the onboarding process, you can lay the groundwork for your company and employees’ long-term success.