Aidar Akmaev
Quick answer: A cybersecurity awareness presentation for employees should teach four habits: long, unique passwords kept in a password manager; multifactor authentication; recognising and reporting scams; and installing updates. Build it around your own reporting channel and one real local example, keep it to about 14 slides and 30 minutes, and use a few dated, sourced statistics.
In short
- 2026 theme"Don't Make It Easy for Them" (National Cybersecurity Alliance). CISA's theme is "Securing the Next 250".
- The deck14 slides in 30 minutes, with short exercises and a quiz. A 20-minute cut is included.
- Free official decksCISA's 2026 toolkit includes PowerPoints. The NCA toolkit has posters and graphics, but no deck.
- StatisticsVerizon DBIR 2026, FBI IC3 2025, UK DSIT 2026, ENISA 2026 and Eurobarometer 2026, each dated and linked.
Disclosure: NOXI publishes this guide and is one of the build options compared below; the outline, statistics and session plan work in any slide tool.
What are the Cybersecurity Awareness Month 2026 themes?
October 2026 has two US themes that point the same way. The National Cybersecurity Alliance (NCA), which runs the public campaign, uses "Don't Make It Easy for Them" [1]. CISA uses "Securing the Next 250", which it says marks the nation's 250th anniversary [3]. The European Cybersecurity Month runs over the same 31 days, this year focused on employees [4].
| Campaign | 2026 theme | Core message | Free materials |
|---|---|---|---|
| NCA (US) | Don't Make It Easy for Them | Strong passwords and a password manager, MFA, recognise and report scams, update software [1] | Tipsheet, 8 posters, 32 social and story graphics; no slide deck |
| CISA (US) | Securing the Next 250 | Avoid and report phishing, strong passwords, MFA and a password manager, update software [2] | PowerPoint template, two ready decks, posters, talking points [3] |
| ECSM (EU) | Cybersecurity Month @ work: Employees' skills under the looking glass | "The strongest layer is human" [4] | ENISA's Awareness Raising-in-a-Box and other resources |
NCA's line frames the whole deck: every habit is one more obstacle for the attacker. The habits are the same everywhere, so only the reporting channels change by country. In the UK, for example, staff can forward suspicious emails to report@phishing.gov.uk and scam texts to 7726 [15]. Check each campaign's terms before putting its logo on a slide.
The 14-slide employee deck, with talking points
Build the deck in three acts: why it matters here (slides 1–3), how attacks reach people (4–7), and the habits and reporting routine that stop them (8–14). Write every title as the takeaway, so the titles alone tell the story. "Say this" is your script.
Act 1: why it matters here (slides 1–3)
| Slide title (the takeaway) | On the slide | Say this |
|---|---|---|
| 1. Don't make it easy for them: four habits that block everyday attacks | Campaign line, four habit icons, session length | "Thirty minutes, four habits and one way to report. None of it needs technical skills." |
| 2. It has already happened here | One anonymised near miss from your organisation; suspicious emails staff reported this year | One minute: what arrived, who spotted it, what it could have cost. Local beats global. |
| 3. Attackers aim at people because it works | 62% of breaches involved the human element [5]; three in four EU employees encountered suspicious messages at work [10] | "This isn't about blame. Most attacks need someone to click, approve or pay. Today is about making that harder." |
Act 2: how attacks reach people (slides 4–7)
| Slide title (the takeaway) | On the slide | Say this |
|---|---|---|
| 4. Phishing is still the most-reported cybercrime | A real phishing email your company received, links removed, with five numbered red flags | Sender, urgency, a link that doesn't match, an unexpected attachment, an unusual request. Then run spot-the-phish. |
| 5. It isn't just email any more | Text, phone call, QR code, and a page asking you to "fix" an error by pasting a command (ClickFix) | "In the phishing simulations Verizon analysed, fake texts and calls were clicked about 40% more often than email [5]. Never paste a command because a web page told you to [9]." |
| 6. A familiar voice is not proof | A voicemail from the "CEO" asking for an urgent transfer; the rule in one line | "Criminals use AI-generated audio to impersonate people you know [12]. Hang up and call back on a number you already have." |
| 7. Changing bank details? Call back first | The callback rule in three steps: pause, verify on a known number, then pay | "Business email compromise accounted for $3.05 billion in losses reported to the FBI in 2025 [7]. One call to a known number breaks the scam." |
Act 3: the habits and the reporting routine (slides 8–14)
| Slide title (the takeaway) | On the slide | Say this |
|---|---|---|
| 8. Long and unique beats complicated | A four-word passphrase next to "P@ssw0rd1"; your approved password manager | "NIST now favours length over symbol rules, drops forced periodic changes and says sites must allow password managers [13]. One password per account." |
| 9. Turn on MFA, and never approve a prompt you didn't start | MFA options from strongest (passkeys, security keys) to weakest (text and voice codes) [14] | "Passkeys and security keys resist phishing. An unexpected prompt means someone may have your password: deny it and report it." |
| 10. Update when asked, restart the same day | 31% of breaches now start with an exploited vulnerability, ahead of credential abuse at 13% [5] | "Updates close the holes attackers use right now. Restart before you log off." |
| 11. Use approved AI tools only, and paste nothing you wouldn't send outside | Your approved AI tools; what never goes in: client data, passwords, unreleased figures, source code | "45% of employees now use AI tools regularly on work devices [6]. In one survey, 43% admitted sharing sensitive work information with AI tools without telling their employer [11]." |
| 12. Report in minutes, and nobody gets blamed | The Report button, the security mailbox and phone number; what happens after a report | Show the button live. "If you clicked, report anyway: the sooner we know, the smaller the problem stays." |
| 13. Clicked? Your first 15 minutes | Four steps at most, for example: report now, keep the message, change the password from another device, follow IT's instructions | Use your own procedure, and say it: nobody gets in trouble for reporting. |
| 14. Four things to do this week | Password manager, MFA on email and bank, updates on, find the Report button; then the quiz | End on actions, not "Any questions?". Run the quiz, then take questions. |
Put each figure's source in a footer line, or add a 15th slide of sources. For fonts, contrast and spacing, see our guide to professional presentation design.
2026 statistics for your slides, with sources
Use two or three numbers, each from the latest edition of a primary report. These were current on 2 October 2026.
| Figure | Slide | Source, published |
|---|---|---|
| Human element in 62% of breaches (60% a year earlier) | 3 | Verizon DBIR 2026, May 2026; breaches Nov 2024–Oct 2025 [5] |
| Exploited vulnerabilities started 31% of breaches; credential abuse fell to 13% | 10 | Verizon DBIR 2026 [5] |
| Fake texts and calls: median click rate 40% higher than email in phishing simulations | 5 | Verizon DBIR 2026 [5] |
| 45% of employees use AI tools regularly on work devices, up from 15% | 11 | Verizon release, 19 May 2026 [6] |
| 1,008,597 complaints and $20.877 billion in reported losses (+26%); phishing/spoofing was the most-reported type, at 191,561 complaints | 3, 4 | FBI IC3 2025 Internet Crime Report, April 2026 [7] |
| Business email compromise: $3.05 billion from 24,768 complaints | 7 | FBI IC3 2025 [7] |
| 22,364 AI-related complaints, $893 million lost; over $30 million to BEC scams involving AI | 6 | FBI IC3 2025 [7] |
| 43% of UK businesses identified a breach or attack in 12 months; 38% faced phishing; 19% provided any staff training | 3 (UK) | DSIT Cyber Security Breaches Survey 2025/26, 30 April 2026 [8] |
| Phishing was 77.8% of the social engineering techniques in EU incidents in 2025; ClickFix and smishing rose | 5 | ENISA Threat Landscape 2026, September 2026 [9] |
| Three in four EU employees encountered suspicious emails, messages or links at work; only 48% said they could recognise an AI-generated fake video | 3, 6 | European Commission Eurobarometer, 30 September 2026 [10] |
| Awareness of MFA rose from 52% (2021) to 77% (2025), but regular use fell to 53%; 41% never use a password manager | 8, 9 | NCA and CybSafe: "Oh, Behave!" 2021–2025, 25 February 2026; 2025–2026 edition, 30 September 2025 [11] |
Three rules keep the numbers honest:
- Say what the number counts. DBIR percentages are shares of the 22,000-plus breaches in Verizon's dataset; IC3 figures cover only what victims reported to the FBI.
- Put the report and year on the slide, in a footer line under the figure.
- Match the audience. Use Eurobarometer or ENISA figures in Europe, DSIT in the UK, and your own incident counts everywhere.
Our guide to presentations with research and citations shows how to check a figure before it goes on a slide.
Interactive elements that work in a 30-minute session
Plan activities where people spot something, decide what to do, and act before they leave, each three minutes or less.
| Activity | Slide | How to run it | Time |
|---|---|---|---|
| Spot the phish | 4 | Show a real phishing email your company received, links removed. Pairs get 60 seconds to find five red flags; reveal them one by one. | 3 min |
| Callback drill | 6–7 | Play a short voicemail "from the finance director" asking for an urgent payment, recorded by a colleague who agrees. Don't clone a real executive's voice. Ask: "What's your next step?" | 2 min |
| Find the Report button | 12 | Everyone opens their email and finds the button or address. Fix any device where it's missing. | 1 min |
| Five-question quiz | 14 | Show of hands or your usual polling tool. | 3 min |
A five-question quiz you can use as is
- A text from "IT" says your password expires today and links to a login page. Don't tap the link: open the company portal the usual way, or report the message.
- You get an MFA prompt you didn't start. Someone may have your password. Deny it and report it.
- Your "CEO" calls asking for an urgent transfer, and the voice sounds right. Hang up and call back on a number you already have.
- Which is stronger: "P@ssw0rd#26" or "copper kettle river sunrise"? The passphrase. Length matters more than symbols.
- You clicked a link and typed your password. Report it now and change the password from another device.
Never shame people who clicked in a simulation; thank whoever reported first instead.
A 30-minute session plan (and a 20-minute cut)
Thirty minutes fits the 14 slides, the exercises and the quiz. For 20 minutes, keep only spot-the-phish and the Report button drill, and merge slides 6–7 and 12–13.
| Minutes | Slides | What happens |
|---|---|---|
| 0–2 | 1 | Theme and promise; show of hands: "Who got a scam text this week?" |
| 2–5 | 2–3 | Your local story and two numbers |
| 5–11 | 4–5 | Phishing anatomy and spot-the-phish; texts, calls and ClickFix |
| 11–16 | 6–7 | Voice scams, payment fraud, callback drill |
| 16–21 | 8–10 | Passwords, MFA, updates |
| 21–23 | 11 | AI tools at work |
| 23–26 | 12–13 | Report button drill; the first 15 minutes after a click |
| 26–30 | 14 | Four actions, quiz, questions |
For the arithmetic behind slide counts, see how many slides per minute. Send a one-page summary the same day, then a short monthly reminder: PCI DSS expects "multiple methods of communication" [17] and HIPAA lists periodic security reminders [18].
Versions for leaders and for schools
Leaders need risk and decisions, not habits. Schools need a staff deck and one sized to the pupils' age.
For leaders and the board: five slides
- Our exposure in one sentence, for example "phishing and supplier payment fraud are our two most likely losses".
- A behaviour scorecard: MFA coverage, phishing report rate, median time to report, devices on current updates, this quarter against last.
- What changed this year: exploited vulnerabilities start 31% of breaches, third parties are involved in 48% and ransomware in 48%, though 69% of ransomware victims didn't pay and the median ransom fell to $139,875 [5].
- The plan and its cost for the next 12 months.
- Decisions needed, such as funding passkeys for the finance team or making MFA mandatory on a legacy system.
Our board meeting presentation guide shows where this fits in the board pack.
A note for schools
For staff, use the 14-slide deck with school examples: a fake parent email, a supplier changing its bank details, a request for pupil records, a staff-room computer left logged in. In the UK's 2025/26 survey, 49% of primary and 73% of secondary schools identified a breach or attack in the previous 12 months, and phishing reached 90% and 96% of those schools respectively [8].
- Staff: the NCSC's free "Cyber Security Training for School Staff" is a scripted PowerPoint pack for INSET days, with a self-learn video and a certificate [16]. It dates from 2021, so add the current figures above.
- Pupils aged 7–11: use the NCSC's CyberSprinters game and teacher-led activities [16]; keep any deck to six to eight visual slides.
- Secondary pupils: replace the payment-fraud slides with what they use: passphrases, two-step verification on gaming and social accounts, never sharing a login code, fake giveaways, and telling a trusted adult when something goes wrong.
What compliance frameworks require from awareness training
PCI DSS, HIPAA, NIST CSF 2.0 and ISO/IEC 27001 all name security awareness training, and PCI DSS is the most specific about frequency and content. If the session counts toward compliance, map it to the clause and keep the evidence.
| Framework | What it requires | Evidence to keep |
|---|---|---|
| PCI DSS v4.x | 12.6.3: training on hire and at least once every 12 months, using multiple methods of communication. 12.6.3.1: training covers phishing and related attacks and social engineering (mandatory since 31 March 2025) [17] | Attendance, materials, yearly policy acknowledgements |
| HIPAA Security Rule | 45 CFR §164.308(a)(5): a security awareness and training programme for all workforce members, including management, covering security reminders, malware, log-in monitoring and password management [18] | Training log, reminder history |
| NIST CSF 2.0 | PR.AT-01: personnel get awareness and training to do general tasks with cybersecurity risks in mind; PR.AT-02 covers specialised roles [19] | Role-based training plan |
| ISO/IEC 27001:2022 | Annex A control 6.3: information security awareness, education and training [20] | Records of awareness activities and competence |
This is a summary, not legal advice. Confirm scope and evidence with your auditor or compliance lead.
How to measure whether the session worked
Measure behaviour, not attendance: more reports, faster reports, and higher MFA and password-manager use. Take a September baseline and compare in November.
| Metric | Where to get it | Good direction |
|---|---|---|
| Report rate (reports ÷ suspicious messages delivered) | Report-button data, simulations | Up |
| Median time to first report | Mail security or security team | Down |
| Click or credential-entry rate in simulations | Simulation tool | Down |
| MFA coverage (% of accounts) | Identity provider | Up, toward 100% |
| Password manager adoption | Licence or activation count | Up |
| Devices on current updates | Device management | Up |
| Quiz score, before and after | The five-question quiz | Up |
Weight the report rate above the click rate: falling clicks can just mean easier simulations, while rising reports mean people are acting. These are common programme metrics, not benchmarks; NIST SP 800-50 Rev. 1 (September 2024) suggests more [21].
Where to get a ready deck: five routes compared
If you want an official deck today, CISA's free 2026 toolkit is the fastest start. If your policy, tools or audience differ from generic advice, build from your own policy. Contents were checked on 2 October 2026.
| Route | What you get | Fits best | Plan for |
|---|---|---|---|
| CISA 2026 toolkit [3] | PowerPoint template, "Cybersecurity Best Practices" and "Key Ways to Stay Secure Online" decks, posters, talking points | US organisations that want official material fast | Adding your reporting channel, policy and local example |
| NCA toolkit [1] | Tipsheet, 8 posters, 32 social and story graphics | Campaign visuals around the session | Building the deck yourself |
| NCSC school staff pack [16] | Scripted PowerPoint, self-learn video, certificate | UK schools | Adding current figures (the pack dates from 2021) |
| Template marketplaces | Designed cyber-themed layouts | Teams that already have the content | Writing content, statistics and sources yourself |
| Build from your policy (by hand, or with an AI tool such as NOXI) | A deck with your rules, tools, contacts and look | Organisations with their own policy, brand or languages | Checking every rule and figure against the source |
How to build the deck in NOXI from your IT policy
Upload your security policy, give NOXI the 14-slide outline as the brief, and edit the result by chat or on the slide. Uploading needs a free account. NOXI is free, with no card and no watermark: every account gets 1,000 credits a month, and a full deck uses about 25.
Step 1 — Collect your inputs
Your IT security or acceptable-use policy (PDF or Word), the incident procedure, last year's training deck and a screenshot of one phishing email with the links removed. Check your organisation's rules before uploading internal documents to any tool, as slide 11 says. NOXI does not use your presentations, prompts or files to train AI models, and data is encrypted in transit and at rest.
Step 2 — Upload the files and write the brief
NOXI turns PDF, Word, Excel or CSV, PowerPoint, text and image files into a structured deck. Paste the three outline tables from this guide as the brief, plus one rule: "Use only the rules, tools and contacts in my files." More in our guide to turning a PDF into a presentation.
Step 3 — Set the style from last year's deck
Upload last year's deck, a brand PowerPoint, a PDF or even an image as a reference, and NOXI designs the new deck in that style: colours, typography and layouts. See AI presentations in your own template.
Step 4 — Review the outline, then generate
Review the outline first and check that the 14 titles tell the story on their own, then generate and watch each slide being built.
Step 5 — Add the statistics and edit
With uploaded files, NOXI works from your files, so paste the statistics you chose with their sources and ask for a source line under each figure. (Decks started from a prompt are researched on the web first, and slides with figures carry a source line linking to where each number came from.) Then edit in plain language, such as "Turn slide 4 into an annotated phishing email with five numbered red flags", click any element to change it, or sketch on the slide on desktop.
Step 6 — Review with IT and HR, then deliver
Invite colleagues as editors to work on the deck together in real time; version history restores earlier drafts. Present full-screen from NOXI, or download an editable PowerPoint (.pptx) or PDF, free and with no watermark. NOXI's export engine writes editable text boxes and embeds the fonts, so the file opens on the training-room PC with your typography. Add your talking points to PowerPoint's notes pane after export if you present from there. "Translate a deck" creates a separate Arabic or English version for bilingual teams.
Three copy-ready prompts
Paste these into NOXI or any AI assistant and replace the brackets. Our collection of 40 presentation prompts has more.
Build a 14-slide cybersecurity awareness presentation for [all staff at Company], for a 30-minute session in October 2026, with the theme line "Don't make it easy for them". Use the attached policy and incident procedure for every rule, tool name and contact; invent none. Three acts: why it matters here (3 slides), how attacks reach people (4), the four habits and how to report (7). Write each title as a full-sentence takeaway.
Turn slide 4 into an annotated phishing email: a fake "shared document" message from [a supplier]. Mark five red flags with numbered callouts: sender address, urgency, mismatched link, unexpected attachment, unusual request. Keep each callout under eight words.
Create one slide titled "Attackers aim at people because it works" with two large figures, each with its source line underneath: 62% of breaches involved the human element (Verizon 2026 Data Breach Investigations Report); three in four EU employees encountered suspicious emails, messages or links at work (European Commission Eurobarometer, September 2026). Use only these figures.
Checklist before you present
Run these five checks the day before.
- The reporting channel works.Send a test report through the button or address on your slide and confirm someone receives it.
- Every figure has a report name and year.Check whether a newer edition has come out since you built the deck.
- The local example is cleared.Anonymised and approved by IT and, if needed, legal or HR.
- The phishing sample is safe.Links and attachments removed; shown as an image.
- Attendance and follow-up are set.Keep the attendee list and deck version if the session is compliance evidence, and schedule the same-day summary email.
Frequently asked questions
- What is the theme of Cybersecurity Awareness Month 2026?
- The National Cybersecurity Alliance's 2026 theme is "Don't Make It Easy for Them", built on four habits: strong passwords and a password manager, multifactor authentication, recognising and reporting scams, and updating software. CISA's theme is "Securing the Next 250".
- What should be included in a cybersecurity awareness presentation for employees?
- Phishing by email, text and phone; payment fraud; passwords and password managers; multifactor authentication; updates; safe use of AI tools; and exactly how to report an incident. Add one local example and two or three sourced statistics.
- How long should a cybersecurity awareness training session be?
- About 30 minutes for an all-staff session, which leaves room for short exercises and a quiz. A 20-minute version works if you merge slides; follow up with short monthly reminders.
- How many slides should a cybersecurity awareness presentation have?
- Twelve to fifteen slides for a 30-minute session. The outline in this guide uses 14: three on why it matters, four on how attacks reach people and seven on the habits and reporting.
- Where can I find a free cybersecurity awareness PowerPoint?
- CISA's 2026 Cybersecurity Awareness Month toolkit includes a PowerPoint template and two ready decks, and UK schools can use the NCSC's staff training pack. NOXI is free and builds a deck from your own policy, exported as an editable PowerPoint with no watermark.
- How often should employees receive security awareness training?
- PCI DSS v4.x requires it on hire and at least once every 12 months, using multiple methods of communication. HIPAA's training standard also lists periodic security reminders. A practical pattern is an annual session plus short monthly reminders.
- What statistics should I use in a cybersecurity awareness presentation?
- Use the latest primary reports: Verizon's 2026 DBIR (the human element in 62% of breaches), the FBI IC3 2025 report ($20.9 billion in reported losses) and, in Europe or the UK, the 2026 Eurobarometer, ENISA and DSIT surveys. Put the report name and year on the slide.
- How do I explain deepfake and AI voice scams to employees?
- Explain that a cloned voice or video can look and sound real, so recognising someone is not verifying them. Teach one rule: confirm any urgent request for money or data through a channel you already trust, such as calling back on a known number.
Sources & methodology
On 2 October 2026 the themes and toolkits were checked on the official NCA, CISA, ENISA and European Commission pages, and each statistic in its original report or the publisher's own release. The outline, session plan, activities and metrics are editorial recommendations built on these sources and common training practice, not the results of a study.
- [1] Theme, four behaviours, toolkit, 1 October kick-off — NCA, Cybersecurity Awareness Month; Get involved.
- [2] Theme, four core steps, Career Week 19–24 October — CISA, Cybersecurity Awareness Month.
- [3] 250th-anniversary theme; PowerPoints, posters, talking points — CISA, 2026 Toolkit.
- [4] ECSM 2026 theme and tagline (30 September 2026) — ENISA, Cybersecurity Month @ work; dates — EU Digital Skills and Jobs Platform.
- [5] 62%, 31%/13%, 40% mobile click rate, ransomware 48%, 69% unpaid, $139,875, third parties 48%, 22,000+ breaches — Verizon, 2026 DBIR Executive Summary; data period — DBIR page.
- [6] AI use from 15% to 45% of employees (19 May 2026) — Verizon News, 2026 DBIR.
- [7] Complaints, losses, phishing/spoofing, BEC, AI-related figures (April 2026) — FBI IC3, 2025 Internet Crime Report.
- [8] 43%, 38%, 19% (30 April 2026) — DSIT, Cyber security breaches survey 2025/2026; schools — Education institutions findings.
- [9] Phishing 77.8%, ClickFix, smishing; 8,257 incidents in 2025 — ENISA Threat Landscape 2026.
- [10] Three in four employees, 48% deepfake recognition (30 September 2026) — European Commission, Eurobarometer.
- [11] 43% AI sharing, 41% never use a password manager (30 September 2025) — NCA, "Oh, Behave!" 2025–2026; MFA awareness 52% to 77%, regular use 53% (25 February 2026) — NCA, "Oh, Behave!" 2021–2025.
- [12] AI-generated audio used to impersonate public figures and relatives; hang up and call the number directly (3 December 2024) — FBI IC3 public service announcement.
- [13] Password length, no composition rules or forced changes, password managers (August 2025) — NIST SP 800-63B-4.
- [14] MFA strongest to weakest; FIDO/WebAuthn phishing-resistant (October 2022) — CISA, Implementing Phishing-Resistant MFA; passkeys — FIDO Alliance.
- [15] UK reporting addresses — NCSC, Report a scam email; Report a scam text.
- [16] School staff pack (2021) — NCSC, Cyber Security Training for School Staff; NCSC, CyberSprinters.
- [17] 12.6.3 — PCI SSC, PCI DSS v4.0 SAQ D; 12.6.3.1 and 31 March 2025 — PCI SSC, Summary of Changes.
- [18] 45 CFR §164.308(a)(5) — Legal Information Institute.
- [19] PR.AT-01 and PR.AT-02 (February 2024) — NIST Cybersecurity Framework 2.0.
- [20] ISO/IEC 27001:2022 (Annex A is in the paid standard) — ISO.
- [21] Learning-programme metrics (September 2024) — NIST SP 800-50 Rev. 1.
Build your October awareness deck in NOXI, free: upload your IT policy and last year's slides, get the 14-slide session in your own style, edit it by chat, and download an editable PowerPoint or PDF with no watermark.
