Phishing Awareness Training Built for Executive and Finance Assistants

Generic security awareness training teaches people not to click suspicious links. That's a start, but it misses what makes executive and finance assistants different. Assistants handle an executive's inbox, accept meeting invites on their behalf, share documents with outside parties and often prepare or initiate payments. Attackers know this and design lures specifically for them.

This guide describes phishing awareness training tailored to assistants: the scenarios that matter, the habits that protect them, how to run simulations fairly and how to measure progress. It pairs with our guides on incident response with remote assistants and wire fraud prevention.

Why assistants need role-specific training

Assistants face lures that most employees never see:

• Executive impersonation: messages that appear to come from the boss, asking for something urgent and confidential.
• Vendor impersonation: invoices or bank-change requests from lookalike domains of real suppliers.
• Calendar-based attacks: meeting invites with malicious links or attachments, sent to the executive's calendar that the assistant manages.
• Document-sharing lures: fake file-sharing notifications that lead to credential-harvesting pages.
• Delegated mailbox confusion: messages that exploit the assistant working in more than one mailbox.
• MFA fatigue and fake help desk calls: attackers calling as "IT" to walk the assistant through approving a prompt.

Training built around these scenarios is far more useful than a generic module.

The core habits

Effective training reinforces a small number of habits until they become automatic:

1. Verify out of band. Any request involving money, credentials, sensitive data or changes to payment details is verified through a known channel, such as a phone number from the directory or the company chat tool, never by replying to the message or calling a number in it.
2. Slow down on urgency. Urgency and secrecy are the attacker's main tools. A legitimate executive will understand a two-minute verification.
3. Check the sender and the link. Look at the actual email address and domain, and hover over links before clicking. Lookalike domains swap letters or add words.
4. Sign in only from known paths. Navigate to applications through bookmarks or the SSO portal, not through links in emails.
5. Never approve an unexpected MFA prompt. If prompts appear that you didn't start, report them.
6. Report early, report everything. Reporting is never wrong, even after a mistake.

Scenarios to include

Build training sessions around realistic scenarios drawn from the assistant's actual work. Examples:

• The CFO's urgent wire. An email from the CFO's name, sent from a lookalike domain, asks the assistant to process a confidential wire to a new vendor before end of day.
• The vendor's new bank. A supplier's accounts receivable contact emails that their bank details have changed, attaching a letter on letterhead.
• The board document. A file-sharing notification invites the executive to view "Board deck - final" and leads to a login page.
• The travel change. A message claiming to be from the airline or travel agency asks for card details to rebook a flight.
• The help desk call. Someone calls claiming to be IT and asks the assistant to read back an MFA code.
• The gift cards. A text from the "CEO" asks for gift cards for a client event.

For each scenario, discuss the warning signs, the correct response and whom to tell.

Simulations, done fairly

Phishing simulations, sending realistic test emails and measuring responses, can build habits when done well. Principles:

• Tell assistants simulations happen, without revealing when.
• Make them relevant: executive and vendor impersonation, document shares and calendar invites.
• Teach in the moment: someone who clicks sees a short explanation of the warning signs.
• Celebrate reports, not just avoided clicks. Reporting is the behavior you most want.
• Don't shame. Never publicize individuals who clicked. Use results to improve training.

Remote assistants should be included in your organization's simulation program alongside employees, with their provider informed.

Measuring progress

Useful measures, tracked over time:

• Report rate: the share of simulated phishing emails reported.
• Time to report after a simulation is sent.
• Click and credential-entry rates in simulations, trending down.
• Real reports of suspicious messages, which should rise as awareness grows.
• Verification adherence: in spot checks, payment or data requests verified out of band.

Making verification easy

Habits stick when the right action is easy. Practical supports:

• A short directory of verified phone numbers for executives and key vendors, maintained securely.
• A written rule that payment and bank-change requests always require a call to a known number and a second approver.
• A "report phishing" button in the email client.
• Explicit permission from executives to verify their requests, and to delay anything that can't be verified.

Executives play a big role. When a CEO tells their assistant, "If you ever get an unusual request from me, call me, even if it says not to," it removes the social pressure attackers rely on.

Calendar and meeting hygiene

Because assistants manage calendars, they need specific guidance on meeting invitations:

• Don't accept invites from unknown external senders automatically; check with the executive or verify the sender.
• Be cautious with invites containing attachments or unusual meeting links.
• Turn off automatic addition of external invites to calendars if your platform allows it.
• Report invites that appear to be phishing rather than simply deleting them.

Similarly, for file sharing, verify unexpected shares from external parties before opening, and open shared documents through your organization's file platform rather than links in notification emails when possible.

AI-generated lures and voice cloning

Attackers increasingly use AI tools to write convincing messages without the spelling mistakes that once gave phishing away, and to imitate voices in phone calls or voicemails. Training should acknowledge this: polished writing or a familiar-sounding voice is no longer proof of legitimacy. The defense is the same as ever, verification through a known channel, but assistants need to know that a phone call "from the CEO" asking for an urgent transfer deserves the same scrutiny as an email. Some organizations agree a simple verification phrase or callback rule between executives and assistants for urgent requests.

Onboarding and refreshers

Cover phishing during onboarding, before assistants get access to sensitive systems, using the scenarios above. Refresh regularly with short sessions and new examples. Share real attempts your organization has seen, with details removed, because recent, local examples are the most memorable.

Including the provider

For assistants supplied by a provider, align training between your program and the provider's. Share your reporting channel and verification rules with the provider's account lead so their guidance matches yours. In account reviews, discuss trends and near misses. See vendor onboarding for how ExecWing coordinates with client security teams.

A worked example

A finance assistant receives an email that appears to come from a long-standing supplier, saying the supplier has moved banks and attaching a letter with new account details. The assistant notices the domain has an extra letter. Following the rule, she doesn't reply. She reports the message through the email client's report button, then calls the supplier using the number in the vendor master file. The supplier confirms no change was requested. Security blocks the lookalike domain and alerts the finance team. At the next training session, the example is shared, anonymized, as a model of the right response.

Common mistakes

Generic training only. Assistants need scenarios from their real work.

Shaming clicks. It discourages reporting.

No verification directory. Make the right action easy.

Executives who resist verification. Leaders must explicitly support it.

Frequently asked questions

Should remote assistants be included in our phishing simulations?

Yes, with their provider informed. They face the same attacks as employees, often more.

How often should training happen?

Cover it at onboarding and refresh regularly with short, current examples. Your security team sets the cadence.

Does ExecWing train assistants on security?

Yes, and we align with your program so guidance is consistent.

What if an assistant falls for a phishing email?

Report, contain and learn. See our incident response guide.