Five points. One page. No jargon.
Most awareness material is written for the people who already care. These are written for everyone else — the person who is about to reply to an urgent message from someone claiming to be the CFO. Print them, pin them by the kettle, drop them into an all-staff email or a Teams channel. They are free, there is nothing to fill in, and we do not ask who you are.
AI-powered scams: pause, check, protect
Voices can be cloned, writing styles can be copied, and the message naming your finance director may not have come from your finance director. The instruction staff actually need is not technical: slow down, and confirm the request a second way before acting on it.
- Why urgency, authority and emotion are the warning signs
- Confirming an unusual request through a channel the sender did not choose
- What must never be pasted into a public AI tool
- Reporting quickly, without fear of being blamed
UK GDPR: handle personal information with care
No member of your staff is ever going to read the UK GDPR. This is the part of it that touches their day: what they may collect, who they may pass it to, and what to do in the first ten minutes after something goes to the wrong person.
- Collecting only what a clear, stated purpose needs
- A lawful basis somebody in the building can actually name
- Not reusing information for a purpose nobody approved
- Reporting loss, wrong recipients and unauthorised access straight away
Automated decisions: a human has to be reachable
Since 5 February 2026, if a significant decision about a person is made solely by a machine, four things are expected of you. The part staff get wrong is spotting when a tool has moved from assisting to deciding.
- Telling the person the decision was made by automated means
- Letting them put their side of it
- A route to a human who can actually change the answer
- Letting them contest the outcome
Strong passwords, safer accounts
Weak and reused passwords are still how most account takeovers start, and no amount of policy fixes a password that also unlocks someone’s personal email. This is the version of the advice that people can act on without being told off first.
- Length beats complexity — four unrelated words, fifteen characters or more
- Why one breach anywhere should not unlock everything
- Using an approved password manager rather than a notebook
- Multi-factor codes are never shared, and unexpected prompts get rejected
- When a password actually needs changing, and when it does not
Need one we have not made yet?
Tell us the behaviour you are trying to change — passwords written on desks, invoices paid without a second check, files shared out of the wrong folder — and if it is a problem other UK organisations share, we will make the poster and put it here free.
We build them in plain English, with no jargon and nothing to buy. No charge, and you do not have to be a client.
Suggest a posterFree to use, in your name
Print them, email them, put them on the screen in reception. You do not need to credit us and you do not need to ask. The only thing we ask is that you do not resell them or present them as a product of your own. If you would rather they carried your logo alongside ours, say so and we will send you that version at no charge.
A poster is awareness. It is not a control.
The first poster tells staff to use only approved AI tools. Most organisations have never written down which tools those are — so the poster asks a question the business cannot yet answer. Our AI acceptable use policy template answers it, and the control set shows where awareness sits among the thirty-six things a UK board is expected to be able to evidence.