One training session a year doesn’t protect your employees from today’s phishing. Scams change every month, and January’s training is long forgotten by the time September’s fake invoice arrives. What works is a short, regular program, tested under real-world conditions.
What a single email can cost
In 2025, spear phishing (targeted phishing, including CEO fraud and fake payment requests) cost the 571 victims who reported it to the Canadian Anti-Fraud Centre $67.9 million. It is the second most costly fraud in Canada, behind investment fraud.
The Centre describes a sharp rise: $31 million in reported losses in the first quarter of 2026 alone. In one case before the courts, a manufacturer wired more than $200,000 in February 2026 after an email impersonating its insurance broker.
The pattern is almost always the same: an email that looks like a routine supplier message asks you to send payment to a new account. The Centre’s spokesperson recommends ongoing training, because fraud keeps changing.
Why yearly training doesn’t hold up
- It fades. An hour of content once a year leaves little behind when the real trap shows up months later.
- It goes stale. Last year’s scams don’t look like this month’s: a cloned executive voice, a fake technician in your team chat, a malicious QR code.
- It measures nothing. Without simulations, you don’t know who would click tomorrow.
What works: a program, not a session
A good program rests on three things: repetition, realism and measurement.
1. Short content, every month. Two modules of 5 to 10 minutes, with a quiz. Short enough to fit between meetings, frequent enough to become a habit.
2. Three angles that rotate through the year:
- What’s happening now: the scams circulating right now.
- Your reality: scenarios drawn from your industry, like a supplier’s fake invoice or an urgent fake customer.
- Learning by doing: modules where employees make decisions and see where they lead.
3. Realistic, measured traps:
- The booby-trapped email: 1 to 2 simulations per employee per month, in French or English, scheduled around your employees’ actual working hours (6 a.m. to 6 p.m. by default, up to 9 p.m. when needed). Fraudsters don’t keep office hours.
- The request with no link: a fake executive asking for a wire transfer or information. We don’t measure clicks, we measure who replies. That is exactly how spear phishing works.
4. The lesson at the right moment. Anyone who gets caught immediately receives a short catch-up lesson. Never a punishment: employees who are afraid hide mistakes instead of reporting them.
5. Results management can read. A monthly report and a weekly update: who completed, who clicked, who reported.
Training doesn’t replace a sound procedure
No program guarantees zero clicks. You also need one simple rule that everyone follows: any change to a supplier’s banking details is confirmed by phone, using the number already on file, never the one in the email. That is the Anti-Fraud Centre’s advice, and it costs nothing.
Employee training also answers a question that almost every cyber insurance questionnaire asks. See our guide: Cyber insurance questionnaire: how to answer without risking your claim.
The UpSystems advantage
UpSystems Solutions Canada, based in Laval and serving businesses across Canada remotely, offers this program in its Optimal Security pack, an option on its managed IT plans:
- Active Monitoring: 6 different campaigns per year;
- Management 360: 12 campaigns, a different one each month;
- Essential: 6 or 12 campaigns, your choice, with a setup fee.
Every new employee receives onboarding training, and the program is renewed every year on request. Campaigns and the sending window are set with you during the initial assessment, based on your industry and your team’s actual hours. See the Optimal Security pack and our plans.
Frequently asked questions
How often should employees get cybersecurity training?
Every month, with short 5- to 10-minute content and 1 to 2 phishing simulations. A yearly session is forgotten before the real trap arrives.
Are phishing simulations meant to catch employees out?
They are for learning, not punishment. Anyone who clicks immediately gets a short lesson, and the results show where to focus training.
How many campaigns does the UpSystems Optimal Security pack include?
6 per year with Active Monitoring, 12 with Management 360, and 6 or 12 with Essential, with a setup fee.
Is training enough to stop CEO fraud?
No. It needs a procedure alongside it: any change to banking details is confirmed by phone, using the number already on file.