Security awareness for executives and assistants
For executives, directors and business owners, and for the executive and personal assistants who manage their mail, calendars and requests. No technical background is needed. 'Recognizing phishing emails and messages' is useful first; payment fraud, finance and HR scams, and deepfake voice and video each have their own course, so this one stays on what is specific to the executive and assistant pair: why attackers single you out (whaling), how delegated access to the executive's mailbox should be set up and reviewed, how much the executive's public footprint gives away, a standing verification agreement between the two of you, and reporting fast. Examples use Microsoft 365 and UK NCSC and US FBI and CISA guidance; your organization's own delegation, travel and reporting rules come first.
- Level
- Beginner
- Length
- About 85 minutes
- Contents
- 5 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Identify why executives and their assistants are targeted by whaling and what attackers want from each role
- Choose the right delegate permission for an assistant and review delegated access to an executive's mailbox
- Reduce what an executive's digital footprint gives away, including out-of-office replies, travel posts and meeting links
- Use a verification agreement between executive and assistant to check unusual requests, new numbers and requests for codes
- Report a suspected whaling attempt or misuse of delegated access quickly, with the evidence the responders need
Course outline
- 1.Why executives and their assistants are targeted by whalingLesson · 12 min
- 2.Choosing delegate permissions and reviewing access to an executive's mailboxLesson · 15 min
- 3.Reducing what an executive's digital footprint gives awayLesson · 14 min
- 4.Using a verification agreement between executive and assistantLesson · 15 min
- 5.Reporting a suspected whaling attempt or misuse of delegated access quicklyLesson · 10 min
- 6.Security awareness for executives and assistants: knowledge checkKnowledge check · 14 questions
- 7.Security awareness for executives and assistants: practical exerciseKnowledge check · 1 question
- 8.Final exam10 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- NCSC: Phishing attacks: defending your organisation (whaling, digital footprint, verifying requests)
- NCSC: Social media: how to use it safely
- NCSC: Phishing scams: spotting scams
- NCSC: How to secure your online meetings
- Microsoft Learn: Manage permissions for recipients in Exchange Online (Full Access, Send As, Send on behalf)
- FBI IC3 PSA I-051525-PSA: Senior US Officials Impersonated in Malicious Messaging Campaign (May 2025; US example)
- FBI IC3 PSA I-091124-PSA: Business Email Compromise: The $55 Billion Scam (September 2024; US example)
- CISA: Avoiding Social Engineering and Phishing Attacks
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.