New Employee Cyber Security Risks: Why Onboarding is Your Weakest Link

When you bring a new person into your business, the focus is usually on making sure they feel welcome and have the tools they need to get started. A laptop, email account, access to systems: maybe even a quick coffee with the team.

But there is one area that often gets overlooked: cyber security.

Keepnet’s research shows nearly three-quarters of new hires fall victim to phishing or social engineering attacks within their first 90 days. That makes the onboarding period one of the most dangerous times for your business’s security, and many owners do not realise it.

Why New Employees Are a Target

Think back to when you started a new job. You were keen to impress, did not fully know the processes, and probably second-guessed whether to question an instruction.

Cyber criminals exploit this uncertainty. They know your new starter has not yet learned what is “normal”. A cleverly written email that looks like it is from HR or a senior manager can be all it takes.

Examples we often see include:

• Fake HR portals asking for personal details
• Bogus invoices that look urgent
• Emails pretending to be from an executive, requesting sensitive information or a “quick favour”

Because your new employee has not built up that workplace instinct, they are 44% more likely to click on these scams compared to longer-serving colleagues. And when the attacker pretends to be a senior executive, that figure jumps even higher. As the National Cyber Security Centre explains in its phishing guidance, these attacks are carefully designed to look authentic and prey on moments of doubt.

The Real Impact on Businesses

We often hear from businesses that only realise the risk when it is too late. A new member of staff might click a link, share credentials, or process a false payment: not because they were careless, but because they were not trained to spot the warning signs.

Attackers know onboarding is a weak point, and research from Proofpoint shows they deliberately target employees during their first few months. Without the right preparation, your newest people could accidentally open the door to a data breach or financial loss.

How to Protect Your Business

The good news is that the risk can be reduced significantly. The key is to start cyber security training from day one, not weeks later once the employee has “settled in”.

Practical steps include:

• Running tailored security awareness sessions during onboarding
• Using phishing simulations to test and educate new hires
• Encouraging staff to question unusual requests, no matter who they appear to come from
• Backing this up with strong security tools like firewalls and email filtering

Businesses that embed security into onboarding see phishing risk drop by up to 30%. It shows that a small investment of time upfront can prevent far bigger problems later. To support this, we include security awareness in our cyber security training, making it a natural part of the induction process.

If you are not sure where to begin, our IT support services also cover practical protections such as managed firewalls and secure email filtering, so your technology and people work together to defend your business.

Your New Starters Don’t Have to Be Your Weakest Link

People are always your first line of defence. But without the right guidance, new employees can become your biggest vulnerability. The difference comes from how you prepare them.

If you’d like help setting up simple, effective cyber security training for new starters or want to review your wider business security, get in touch or fill out the form below to speak to our support team.