Managed Cybersecurity
Security Awareness Training for Dealership Employees
The attacks that hurt a dealership usually start with a message to the controller, the BDC or the service drive. Our training, written by Helion’s own team, teaches your staff to catch them.
Security awareness training for dealerships teaches everyone with a login, from the controller to the BDC to the service advisors, to spot phishing emails, fake invoices and impersonation calls aimed at car and truck stores, and to report them.
Last updated: October 17, 2026
Attacks on a Dealership Start at a Desk
The email that costs a store money rarely looks dangerous. It looks routine. It’s a parts vendor’s “updated remittance details” landing in the controller’s inbox on a Thursday afternoon, or a lead in the BDC queue with a PDF attached, or a text to a sales manager that seems to come from the GM. Business email compromise alone cost victims $3.05 billion in 2025, according to the FBI’s 2025 Internet Crime Report, and CDK Global’s research found 35% of auto dealers had a cyberattack or incident in 2024.
Security awareness training is the part of cybersecurity for dealerships that works on people instead of machines. Helion Technologies writes its own dealer-specific materials and runs the training as part of its managed security, with the same team that answers your help desk calls. If you’d like the background on why training belongs in a security program at all, our guide to employee cybersecurity awareness training covers it. This one is the service.
A firewall stops a lot. It can’t stop someone typing in their own password.
The Team Behind the Training
The people who write the training support more than 35,000 dealership employees every day, so they know what lands in a dealership inbox on a normal Tuesday, from the fake shipping notice to the lender email with one letter wrong in the address. And when somebody isn’t sure about a message, they can call and get a live person. The help desk is live from 6 a.m. to midnight Eastern, Monday to Saturday, with after-hours and weekend support included. Same team. Same phone number.
Where it starts
Five Desks, Five Ways In
Generic training talks about “the finance department” and “your CEO.” A dealership has a controller, a BDC, a service drive and an F&I office, and cybercriminals know exactly which one to write to. They choose well. This is where our security awareness training for dealerships spends its time.
| Desk | What lands there | The habit that stops it |
|---|---|---|
| The controller and the accounting office | An email from a known vendor or the floor plan lender with new wiring instructions, often sent from that company’s real account after someone broke into it | Call the vendor back on the number already on file before a single bank detail changes |
| The BDC | Messages from strangers all day long, because that’s the job, including attachments and links that ask for a sign-in | Nothing that asks for a password gets typed into, and a strange lead gets reported, not deleted |
| Service advisors | A parts or warranty invoice nobody ordered, or a “customer” sending photos of the damage through a link | Match it to a repair order before opening anything |
| The F&I office | A lookalike lender or credit portal page asking them to sign in again | Open the portal from a saved bookmark, never from the email |
| Sales managers and the desk | A text or call that seems to come from the GM or the dealer principal, asking for gift cards or a quick favor before lunch | Confirm through a second channel, every time, no matter who it seems to be |
These are the patterns that show up across the dealerships we support, written as the habits the training builds. They’re getting harder to spot, too. The same FBI report counts more than $30 million in 2025 losses to business email scams that used AI, which is how a fake vendor message ends up reading exactly like the real one. To see what an attacker could reach after one of those clicks, our complimentary Hackability Test shows it from the inside.
Written for Dealers, by Helion’s Own Team
Here’s what usually happens with an off-the-shelf course. It was built for every industry at once, so the bad emails in it come from a bank or a hospital. Your advisors click through the videos on a slow afternoon, pass the quiz and go back to the counter. A week later a parts invoice turns up from a supplier nobody’s heard of, and nobody connects the two. Why would they? Helion’s team writes its own material for dealerships so that connection gets made. Erik Nachbahr, our founder and president, says it the way he’d say it to a dealer: “it’s specifically tailored to dealers. Like, it’s dealer-specific.”
The examples are a controller’s inbox, a BDC queue, a repair order and a lender portal, because that’s where your people work. That’s deliberate. It also has to stay current. The FTC Safeguards Rule asks for training that’s updated as needed to reflect the risks your own risk assessment finds at your stores, so when the scams change, the material changes too.
People remember their own desk.
Off-the-shelf training
Built for any company. The bad emails come from banks and hospitals, and the advice is about a “CEO” your store doesn’t have.
Passed, then forgotten.
Helion’s dealer-specific training
Our own team writes it for car and truck dealerships. The bad emails come from parts vendors, lenders and “the GM.”
It looks like Monday morning.
The newest module
AI Use Belongs in the Training Now
Your salespeople are already using AI to write follow-up emails and tidy up deal notes, and a lot of it happens on personal accounts nobody at the store can see. That’s new territory. So our training now covers AI use alongside phishing. For stores that want a sanctioned platform instead of a ban, that’s the job of Managed AI.
“We’re not seeing dealers doing anything with AI security training.”
Erik Nachbahr, Founder & President, on an October 2026 webinar about AI governance. Watch the clip or read AI governance for dealerships.
What the AI module covers Three questions staff ask, and the answers we teach
Accounts “Can I just use my own ChatGPT?”
Not on a dealership computer, and not for dealership work. A personal account has no audit trail and no off switch. Nobody can shut it down. If a salesperson uploads their customer list to one, that list walks out the door with them on their last day, and the store never knew it was there.
Company work goes in a company account.
Uploads “What’s the harm in having it check one email?”
That one email has a customer’s name and phone number in it, and maybe a payoff amount. Paste it into an AI tool the store doesn’t control and that information now sits somewhere you can’t see or delete. You can’t take it back. We teach a plain rule, which is that nothing about a customer goes into an AI the dealership doesn’t manage.
If it’s about a customer, it stays in.
Training setting “Doesn’t it forget what I typed?”
Often it doesn’t. Unless someone has switched it off, a lot of AI tools keep conversations and use what you give them to train the model, so it can surface for somebody else later. A corporate platform lets the store turn that off for everyone at once. Staff learn to check which kind of account they’re in before they type.
Know where your words go.
How Security Awareness Training Starts
-
1
Request the assessment
Fill in the short form for our complimentary IT and cybersecurity assessment. It costs nothing, carries no obligation, and you don’t need to be shopping for a new provider.
-
2
We look at who can be reached
An engineer reviews who has a login, what email protection sits in front of them and what training your staff have had so far.
-
3
Findings arrive in writing
You see where an attacker would most likely get in, desk by desk, and what the training would need to cover at your stores.
-
4
You decide what’s next
Handle it yourself, or let us run it as part of managed cybersecurity. Onboarding starts within weeks of signing. On the co-managed path your own IT manager stays in charge.
Common Questions
Not sure what your staff would click?
A complimentary IT and cybersecurity assessment answers that in writing. Already know what you need? Get a price quote.
What does security awareness training cover at a dealership?
Who at the dealership needs to take it?
Does the FTC Safeguards Rule require security awareness training?
Why does it matter that the training is dealer-specific?
Is penetration testing part of the training?
Should AI use be part of security awareness training?
Attacks on a dealership usually start with somebody at a desk. Let’s make sure they know what to do with it.
Request a Complimentary Assessment →