Senegal cybersecurity awareness training employees: 12 educational modules (2026)

Cybersecurity awareness: the #1 ROI measure in SMEs

Out of 65 Senegal SME incidents 2024-2025 analyzed, 62% had the human as initial vector (phishing click, unknown USB plugged, password shared on WhatsApp). Not a technical flaw: an untrained employee.

Employee cybersec training cost: 5-25 EUR / user / year. Average SME security incident cost: 5-50 M FCFA. ROI: demonstrable in 1 prevented incident.

Yet 87% of SMEs I've audited have never trained their teams on cybersecurity. It's the most profitable and most neglected measure.

This guide structures a 12 educational modules program (1 per month) deployable over 1 year, with international + local tool options.

H2: The 12 modules

Module 1 — Email phishing (Month 1)

Why priority: 91% of cyberattacks start with email phishing (Verizon DBIR 2024).

Content (45 min):

• Definition + real examples (BICIS bank phishing, fake Wave, fake Microsoft).
• Warning signs: urgency, suspicious sender, link hover, spelling mistakes, unusual requests.
• Procedure: never click if doubt, report to IT, delete.
• Exercise: phishing simulation (controlled trap email sent, click rate measure).

Module 2 — Passwords & MFA (Month 2)

Content (40 min):

• Why password alone = weak (credential stuffing, dictionary, breach).
• Team password manager (1Password / Bitwarden — cf dedicated article).
• MFA explained (cf dedicated article): TOTP, Push, FIDO2.
• Exercise: install password manager + enable MFA on 3 critical accounts.

Module 3 — Phone phishing (vishing) + SMS (smishing) (Month 3)

Senegal-specific: fake Wave SMS, fake "Orange Money account problem" call, fake "DGID tax urgency" call.

Content (35 min):

• Real Senegal 2024-2025 cases.
• Procedure: hang up, callback official number, never give OTP code.
• Exercise: role-play (trainer calls, employee must refuse).

Module 4 — USB keys and external hardware (Month 4)

Content (30 min):

• Unknown USB found = don't plug (BadUSB cases, auto-launch ransomware).
• Policy: only company encrypted USBs.
• Exercise: "USB drop" test (USBs left in offices, measure who plugs, who reports).

Module 5 — Mobile and BYOD (Month 5)

Content (45 min):

• Mandatory screen lock (6+ PIN, biometric).
• Official apps only (no random APK).
• WhatsApp 2-step verification + encryption to enable.
• MDM if corporate BYOD (Intune, Jamf, Hexnode).
• Exercise: audit own phone (security settings).

Module 6 — Public WiFi and VPN (Month 6)

Content (35 min):

• Cafe / hotel / airport WiFi = potential compromise (man-in-the-middle, evil twin).
• Procedure: mandatory corporate VPN, never admin access without VPN.
• Personal 4G/5G hotspot > public WiFi for sensitive accounts.
• Exercise: configure corporate VPN on smartphone + laptop.

Module 7 — Social engineering (Month 7)

Content (50 min):

• Definition: psychological manipulation to obtain info or access.
• Vectors: LinkedIn pretexting, fake IT support, fake CEO fraud (BEC Business Email Compromise — 2024 Senegal SME stolen 28 M FCFA case).
• Procedure: "callback" rule (verify via different channel), no urgent transfer without second-person validation.
• Exercise: tabletop scenario "CFO receives email from CEO requesting urgent 5M FCFA transfer, what to do?".

Module 8 — Sensitive data: GDPR / Senegal CDP (Month 8)

Content (45 min):

• Senegal CDP (Law 2008-12): personal rights, company obligations, sanctions.
• Sensitive data: health, finance, religion, opinions, biometrics.
• Best practices: encryption, minimal access, don't extract to personal Drive, don't share via WhatsApp.
• Exercise: audit own workstation: what sensitive data do I have locally, is it protected?

Module 9 — Data leak detection + incident procedure (Month 9)

Content (40 min):

• Warning signs: unusual machine performance, missing/encrypted files, antivirus alert, locked accounts.
• Procedure: isolate immediately (disconnect network), notify IT / CIO, don't reboot (forensic evidence loss), document.
• Exercise: tabletop simulation "you see ransom note on your PC, action minute by minute".

Module 10 — Social media & OSINT (Month 10)

Content (35 min):

• LinkedIn / Facebook / Instagram = attacker intelligence (birth date, family, employer, frequent places → security questions, spear phishing).
• Pro best practices: no company info sharing (badges, screens, locations), personal private profiles, privacy settings.
• Exercise: personal LinkedIn profile audit (what would attacker see?).

Module 11 — Physical security (Month 11)

Content (30 min):

• Tailgating (following in secured corridor).
• Shoulder surfing (reading screen behind in transport).
• Locked screen when stepping away (Windows+L, Cmd+Ctrl+Q).
• Shredded sensitive papers (not trash).
• Exercise: office tour: how many unlocked screens do we find?

Module 12 — Wrap-up + certification (Month 12)

Content (60 min):

• Final quiz 30 questions drawn from previous 11 modules.
• Internal participation certificate.
• Open discussion: difficulties faced, suggestions.
• Year 2 plan: advanced modules (for specific roles: devs, finance, HR).

H2: Recommended pedagogical format

Effective modalities (by ROI order):

• Phishing simulation (KnowBe4, Hoxhunt): monthly trap email send, click measure, contextual training who clicks. Most effective.
• Micro-learning video 5-10 min: short video capsules (Wizer, NINJIO).
• Monthly interactive quiz.
• Quarterly tabletop / role-play (most emotionally memorable).
• Annual in-person training (for leadership + new hires).

To avoid: 100-page PDF, only 4h annual in-person training (80% forgotten at 6 months).

H2: 2026 provider comparison

KnowBe4 (USA — the leader)

• Price: ~12-25 EUR / user / year by volume.
• Pros: 5000+ videos, top-tier phishing simulation, multi-language (French included), detailed reporting.
• Cons: price, very "US-flavored" content.
• For: SMEs 50+ employees, banks, regulated sectors.

Hoxhunt (Finland)

• Price: ~10-18 EUR / user / year.
• Pros: deep gamification (XP, leaderboards), employees become company "defenders". Very good engagement.
• Cons: mostly mid-market suited.
• For: tech SMEs seeking engagement.

Cofense PhishMe / Proofpoint Security Awareness

• Price: 8-20 EUR / user / year.
• Pros: Proofpoint / Cofense security suite integration.
• For: companies already on Proofpoint email security.

Wizer (low-cost)

• Price: free up to 10 users, ~3-6 EUR / user / year beyond.
• Pros: very accessible, decent content.
• Cons: less rich than KnowBe4.
• For: Senegal TPEs, starting.

Local / custom Senegal solutions

• Dakar cybersec firms (Optimus, Defense Communication, others) offer 2-4h in-person workshops.
• Price: 300-1,500 KFCFA / workshop (10-20 person group).
• Pros: local context adaptation (real Senegal cases, Wolof if needed), local network.
• Cons: no continuous platform, no automated phishing simulation.
• For: complement KnowBe4/Hoxhunt with 1-2 in-person workshops/year.

Open source / DIY

• OWASP Cyber Defense Matrix, CISA free, France ANSSI free resources (French).
• Pros: 0 EUR, solid content.
• Cons: building program takes 40-80h internal.
• For: motivated TPEs 5-15 employees.

H2: Realistic budget SME 20 employees

Reco SME 20 employees: Hoxhunt or KnowBe4 (~315 KFCFA / year) + 1 local workshop (500 KFCFA) = ~815 KFCFA / year = ~40 KFCFA / user / year. Unbeatable vs incident cost.

H2: Measuring impact

Metrics to track monthly:

• Phishing click rate: % employees clicking on sim phishing. Goal: from ~30% (baseline) to <5% in 12 months.
• Phishing report rate: % employees reporting sim phishing. Goal: >40%.
• Module completion rate: % employees finishing monthly module. Goal: >85%.
• Quiz scores: average module quiz. Goal: >75%.
• Real incidents per quarter: year 1 baseline, year 2 -50% goal.

FAQ

How much training time per month?

30-60 minutes / employee / month. Total 6-12h / year. Micro-learning format preferable to 4h annual block.

How to enforce participation?

• Leadership sponsor (CEO signs launch email). 2. Mandatory modules (manager reminder). 3. Gamification (leaderboard, badges). 4. Link to annual reviews. 5. Consequence after 3 unanswered reminders.

Training in Wolof or French?

By team profile: most Dakar tech SMEs = French OK. Field / sales / ops SMEs: add Wolof capsules for key terms (phishing, password, personal data). Local provider can adapt.

Phishing simulation alone cost?

KnowBe4 PhishER Plus: ~4-8 EUR/user/year. Gophish (open source): 0 EUR but requires SMTP server + admin. For 20-person SME: KnowBe4 or Wizer more cost-effective.

Measurable ROI?

Yes: track click rate baseline → 6 months → 12 months. SMEs I've seen go from 35% to 4% click rate in 9 months. 1 prevented phishing = ROI x10-50.

Let's discuss your case

If you want to deploy a cybersecurity awareness program for your SME in Senegal, we can design the 12-month journey and select the tools. WhatsApp +221 77 596 93 33.