Most security awareness programs assume an employee at a desk with a company computer and a spare half hour. Construction and energy companies employ many people who work outdoors, use a phone as their main device, and have little patience for a slide deck. Yet these workers receive the same phishing texts and fake invoices as everyone else, and their devices hold the same company access.
Training that fits their day will do more than any policy that sits in a binder.
Why field crews matter
A foreman's phone may hold email, project platform access, drawings, timekeeping, and photos of the site. A stolen password from the field can be as damaging as one from the office. Attackers also target field staff with texts that impersonate the boss, a dispatcher, or a fuel card provider, because they know people respond quickly on the go.
Principles for field training
Keep it short
Five to ten minutes at a safety meeting or toolbox talk beats a one-hour course. Treat cyber topics the way you treat a safety reminder: one idea, a real example, a clear action.
Use real situations
Show examples that crews actually receive: a text claiming to be from the owner asking for gift cards, a notice about an unpaid rental, a link to view a revised schedule. Realistic examples are remembered.
Speak plainly
Avoid jargon. Say fake message, not social engineering. Say second step to sign in, not multi-factor authentication, at least at first.
Make the right action easy
If reporting a suspicious message takes five steps, people will skip it. Give them one number to call or text, or one button.
Build on safety culture
Construction already has a strong habit of stopping work when something looks wrong. Frame cyber reports the same way. Stop, look, and report.
A sample set of short sessions
- The fake boss text. If the owner or a supervisor texts asking for money, gift cards, or a favor, call them on a number you already have before doing anything.
- Do not approve a sign-in you did not start. If your phone asks you to approve a login you did not initiate, deny it and tell IT. Someone has your password.
- Lost or stolen device. Report immediately. Quick reporting lets IT lock or wipe it before anyone gets in.
- Public Wi-Fi and charging. Avoid using unknown Wi-Fi for company work and do not plug your phone into unknown USB ports.
- Photos and drawings. Know which photos and documents can be shared outside the company, and use approved tools instead of personal messaging apps.
- Links in texts and emails. Do not sign in through links you were not expecting. Open the app directly.
- Passwords. Use a password manager and never share logins, even for convenience at the trailer.
Reinforce between sessions
- Post a simple one-page reminder in the job trailer.
- Include a short tip in the weekly crew message.
- Recognize people who report suspicious messages.
- Send occasional practice messages, and discuss them without blame.
Include subcontractors and temporary staff
Give short orientations to people joining a project, including those who will use shared tablets or the jobsite network. Set clear rules about what they may connect and access.
Measure what matters
Track how many suspicious messages are reported, how quickly lost devices are reported, and how many people fall for simulated messages over time. The goal is a rising report rate and a falling click rate, not a perfect score.
Support the training with technology
Training works best with controls behind it. Make sure field devices are managed and encrypted, require a second sign-in step for company accounts, filter email and texts where possible, and give IT the ability to lock or wipe a lost device.
How Ironfield Cyber can help
Ironfield Cyber builds short, practical training for field crews, along with the device management and email protection behind it. If you would like a ready-to-use set of toolbox talk sessions for your foremen, we can put them together for your company.