As the weather gets warmer and employees start looking forward to their vacations, enterprises should be wary. While the summer is seen as a time to be outside and active, many cybercriminals are waiting to take advantage of an unwary organization and steal sensitive information.

This is in part because employees on the move are more likely to access unsecured wifi networks. Public wifi may be convenient, but it can risk the compromise of sensitive data. For organizations, it may be difficult to respond. Not only is it nigh-impossible to track wifi usage outside of the office, but having fewer staff during the summer months can reduce response time in the event of a breach.

Some companies may invest in full time staff meant to screen against a breach. However, this is often not effective, especially if the staff are not specialized in cybersecurity. Combined with the cost of labor, maintaining a defense in this way is not cost-effective.

The solution lies in stopping the problem at its source—the people that can cause a breach. Many employees may not even be aware of the problematic conduct that can lead to a cyberattack, and awareness goes a long way. Paying to train employees against a cyberattack may be a more effective use of revenue than paying full time IT staff to hedge against breaches.

Of course, teaching employees the principles of cybersecurity is something worth spending time on and executing correctly. In many cases, enterprises may have security training in place due to compliance laws. This is often done as a way of checking boxes rather than providing any meaningful education.

For instance, some types of training may be entirely online, with employees required to read a short pamphlet and complete a test verifying that they understand its contents. This approach, though simple for management, does not foster good retention and may not adequately cover the types of threats an organization might experience. It’s all too easy to grow complacent with training, even as its limitations open up new attack surfaces for cybercriminals.

Generally, the best way to train involves small groups of five to ten employees. Training should involve roleplaying several common scenarios and teach employees how to spot red flags and respond to potential problems. Threat assessment should be the priority for training, as many may not know what a potential cyberattack looks like.

Threats can take many forms, both digitally and physically. Phishing schemes are the most common, with an innocuous-looking emails downloading a payload that can sit on an employee’s computer for some time, compromising the machine and even spreading to others. Other red flags can happen in a workspace, such as an individual masquerading as an IT professional and planting problem files on a computer under the guise of performing work.

Whatever the nature of an attack, employees should feel empowered to not only detect these red flags, but report on them as well. It does an organization no good to criticize an employee that raises a false alarm, as this can discourage them from speaking up in the event of an actual problem.

When it comes to dealing with cyberattacks, preventing them is vastly better than containing them once they’ve started. Because of this, it’s worth examining an employee training program geared toward an enterprise’s needs. New attack surfaces mean new issues, and training that starts before cybersecurity becomes a problem can pay dividends—even if an organization doesn’t know it.