Cybersecurity Basics: Using Your Work VPN
CEFR: B2
Read/Listen first
On Monday morning, Claire connected to her company VPN at home to open confidential company files. She left it on all day while she answered emails and quickly checked her online banking. In the afternoon, a red security alert popped up saying that someone had tried to log in from another country. Claire panicked because she has used the same password for work and for her bank for many years. She called the IT helpdesk and explained the situation. The technician told her that the VPN protected the connection to the company network, but it could not fix weak passwords or stop every phishing email. He said she must create a unique strong password, and she should activate two-factor authentication. Claire realised that she has ignored basic cybersecurity advice for a long time, but after this incident she promised she would take online security more seriously in the future.⚡ Learning goals
- I can explain a simple cybersecurity incident at work.
- I can describe why a company uses a VPN to protect data.
- I can give basic advice about passwords and phishing emails.
✨ Key language
- There was a security alert on my account “There was a security alert on my bank account.”
- use the VPN to access the company network “I use the VPN to access the company network safely.”
- You must create a strong, unique password “You must create a strong, unique password for each site.”
⚙️ Rules & Grammar — 4 Structures
1️⃣ Past simple for security incidents
Rule: Use the past simple to describe finished security events at a specific time in the past.Examples: Claire connected to the VPN; The alert popped up; She called the helpdesk.
Common pitfall + fix: Learners mix present and past forms in one story — keep past simple for the main actions and avoid “I connect yesterday”.
Which sentence correctly uses the past simple for a finished incident?
Tip: Use -ed or the second form of the verb to describe past security events.
Fill with the best answer: Yesterday I ___ a strange security alert on my screen.
Tip: Use the past form “saw” for a completed action in the past.
2️⃣ Present perfect for ongoing habits and results
Rule: Use the present perfect to talk about security habits or changes that started in the past and are relevant now.Examples: She has used the same password for years; I have changed my login details; We have ignored some alerts.
Common pitfall + fix: Students add a specific past time with present perfect — remove exact dates and use it for general time only.
Which sentence is a good example of the present perfect for security habits?
Tip: Present perfect often uses “for” or “since” to show how long something has continued.
Fill with the best answer: For years many employees ___ basic cybersecurity advice.
Tip: Use “have” or “has” plus the past participle to form the present perfect.
3️⃣ Modals of obligation: must / should
Rule: Use “must” and “have to” for strong rules, and “should” for softer advice about cybersecurity.Examples: You must create a strong password; You should activate two-factor authentication; Staff have to use the VPN for company files.
Common pitfall + fix: Learners sometimes add “to” after must — remember we say “must change”, not “must to change”.
Which sentence gives a clear security rule?
Tip: Use “must” for rules from the company or from security policy.
Fill with the best answer: You ___ ___ your password after a serious security alert.
Tip: Use “should” plus the base verb to give strong but polite advice.
4️⃣ Would for future intentions after an incident
Rule: Use “would” to talk about future behaviour you decide after a security problem or to describe imagined reactions.Examples: After this alert, I would change all my passwords; I would call IT if I saw a phishing email; She promised she would take security more seriously.
Common pitfall + fix: Learners confuse “will” and “would” — use “would” when the decision depends on a condition or situation.
Which sentence shows a conditional future reaction to a problem?
Tip: Use “would” with “if” to talk about what you might do in a similar situation.
Fill with the best answer: After this incident she promised she ___ ___ online security more seriously.
Tip: Combine “would” with the base verb to show a decision for future behaviour.
✍️ Vocabulary
VPN (virtual private network)
Meaning: a secure connection that protects your data when you access a network remotely.Synonyms: secure tunnel, encrypted connection, protected link.
Chunk/Idiom: connect to the company VPN before opening confidential files.
Example: I always start the VPN before I open company files at home.
Morphology: noun; abbreviation; often followed by verbs like connect or use.
Self-practice: Write two sentences about when you normally use your VPN at work.
security alert
Meaning: a warning message that tells you about a possible risk or attack.Synonyms: warning message, threat notification, security warning.
Chunk/Idiom: receive a security alert about an unusual login attempt.
Example: A security alert appeared when someone tried to log in from abroad.
Morphology: noun phrase; security is an adjective, alert is a noun here.
Self-practice: Note three details you should always read carefully in a security alert.
strong password
Meaning: a complex password that is difficult for other people or software to guess.Synonyms: complex password, secure password, unique login code.
Chunk/Idiom: create a strong password with numbers, symbols and mixed letters.
Example: Her new strong password uses twelve characters and special symbols.
Morphology: noun phrase; strong is an adjective, password is a noun.
Self-practice: Design one strong password example and explain why it is safe.
phishing email
Meaning: a fake message that tries to steal your data, password or money.Synonyms: scam message, fraudulent email, malicious message.
Chunk/Idiom: report any phishing email to your security or IT team.
Example: The phishing email copied our bank logo but the address looked wrong.
Morphology: noun phrase; phishing is a noun from the verb phrase to phish.
Self-practice: List three signs that help you recognise a phishing email quickly.
company network
Meaning: the set of computers, servers and systems that belong to an organisation.Synonyms: corporate network, internal systems, organisational infrastructure.
Chunk/Idiom: log in to the company network only through an approved VPN.
Example: The VPN gives secure remote access to the company network from home.
Morphology: noun phrase; company is a noun used like an adjective before network.
Self-practice: Describe which parts of your work depend on the company network.
two-factor authentication
Meaning: a security process that requires two different proofs of identity to log in.Synonyms: multi-step login, extra verification, second-factor check.
Chunk/Idiom: turn on two-factor authentication for important work and banking accounts.
Example: With two-factor authentication, you enter a code from your phone after your password.
Morphology: noun phrase; two-factor is a compound adjective before authentication, a noun.
Self-practice: Decide which three accounts you will protect with two-factor authentication today.
☁️ Examples (+ audio)
Our VPN protects access to the company network from home.
I have used different strong passwords for all critical accounts.
You must report any strange security alert to the helpdesk.
I would call IT immediately if I received a phishing email.
✏️ Exercises
Grammar
Choose the best sentence about Claire's actions this morning.
Tip: Keep all main verbs in the past simple when you tell the story.
Which sentence correctly uses the present perfect about Claire's habit?
Tip: Use “has” or “have” plus the past participle for long-term situations.
Fill with the best answer:
Employees ___ change weak passwords after any serious incident.Tip: For strong rules from the company, choose “must”.
Fill with the best answer:
If I saw another security alert, I ___ ___ IT immediately.Tip: Combine “would” with the base verb to describe your reaction to a risk.
Vocabulary & Comprehension
Why did the security alert appear on Claire's screen?
Tip: Look for details about unusual login attempts in the alert text.
According to the technician, what does the VPN mainly do?
Tip: Focus on what the technician clearly states about the role of the VPN.
Fill with the best answer:
Claire used the VPN when she did her online ______.Tip: Think about which financial activity is mentioned in the story.
Fill with the best answer:
The technician warned her that the VPN cannot stop every ______ ______.Tip: Use the two-word expression for a fake message that tries to steal data.
✅ Guided practice
Mini-dialogue:
A: Hi, this morning I got a security alert while I was using the VPN.B: OK, tell me exactly what happened and which accounts you were logged into.
A: I was checking my online banking and some confidential company files when it appeared.
Why this matters:
Strong cybersecurity habits protect both company data and your personal money. When you ignore alerts, small issues can quickly become serious incidents. Clear language helps you explain problems fast to support teams so they can react effectively.Verb & Adjective Pack:
secure — Our VPN keeps the connection secure when we work from home.suspicious — The login location looked suspicious, so she called IT.
encrypted — All confidential files are encrypted on the company network.
to reset — He had to reset his strong password after the incident.
to monitor — The security team will monitor unusual login attempts this week.
Try & compare:
Fill with the best answer: If you ___ a strange alert, report it immediately.
Tip: Use the base form of the verb after “if” for general rules.
Self-correction: Fix the sentence: I have use the same password everywhere for years.
Tip: Remember to add the past participle after “have”.
Practice aloud: Listen, repeat, then type the sentence.
the technician said i must change my password and enable two-factor authentication.
Tip: Pay attention to the stress on “must” and “two-factor authentication”.