- Good training is short, regular and built on real situations, not an annual video.
- Cover phishing, payment fraud, passwords and MFA, and what to do when something goes wrong.
- Think minutes a month per person, not days a year.
- Free resources cover the basics well. Paid tools add realistic practice in real inboxes and a record of progress.
What security awareness training should cover
Security awareness training is anything that helps the people in your business notice a scam, make a safer choice and speak up quickly. In a small team, that person is often the only check between a convincing email and a payment going out or a password being typed in. You don't need a long syllabus. Six topics cover most of what small businesses actually run into.
1. Spotting phishing emails
The core habit: before clicking or paying, check who really sent it, whether you were expecting it, where the link goes and whether it's rushing you. Now that AI writes fluent emails, spelling mistakes aren't a reliable clue any more. Teach people to judge the request, not the writing. Our guide to spotting AI-written phishing goes into detail.
2. Invoices and payment changes
For many small businesses, the most expensive scam isn't a virus. It's a polite email asking you to update a supplier's bank details. Anyone who can pay an invoice should know one rule by heart: payment changes are confirmed by phone, using a number you already have.
3. Passwords and multi-factor authentication
A password manager, a different password for every account, and multi-factor authentication (MFA) switched on wherever it's offered. These three habits mean a single stolen password doesn't open everything.
4. Calls, texts and QR codes
Scams don't stay in the inbox. Texts, phone calls, QR codes and voice notes all pull people somewhere with fewer protections, and AI voice cloning makes a call from "the boss" more convincing. The habit is the same: check through a channel you already trust.
5. What to do after a click
Everyone clicks something eventually. What matters is what happens next: stop, tell someone, change the password from a trusted device, check MFA, report the email. Our clicked a phishing link checklist is short enough to print and stick by every desk.
6. How and where to report
People should know exactly who to tell and how. In the UK, suspicious emails can be forwarded to the NCSC at report@phishing.gov.uk. Inside your business, make it one simple step, and thank people every time they use it. A team that reports quickly protects everyone else who got the same email.
How much time it takes
Less than most owners expect. The mistake is treating training as a once-a-year event that eats an afternoon. Short and regular works better, because the goal is a habit, and habits come from repetition.
A realistic shape for a small team looks like this. Each person spends around half an hour on the basics when they join. Our free security training has 11 lessons of two or three minutes each, about 27 minutes in all. After that, it's a few minutes a month: one practice email, and a 60-second lesson if they click it. For whoever runs it, the work is mostly set-up and a quick look at the results each month.
That's the trade-off worth explaining to a sceptical team. A few minutes a month is far less disruptive than a long annual session, and it's much closer to how scams actually arrive: one at a time, on an ordinary working day.
Free vs paid options
You can get a long way without spending anything. The question is what you need beyond the basics.
What you can do for free
- Free lessons. Our security training covers phishing, AI scams and deepfakes, passwords and MFA, invoice fraud and what to do if you click. No sign-up, and you can share the link with the whole company.
- A quick test. The free phishing test shows six real-looking emails and explains the red flags. It's a low-pressure way to start a conversation at a team meeting.
- Official guidance. The UK's National Cyber Security Centre (NCSC) publishes free advice and staff training material written for small organisations.
- Your own examples. When a real scam lands in someone's inbox, share a screenshot (with personal details removed) and talk through the clues. It's the most relevant training you'll ever get.
What free options can't easily do is test the habit in the place it matters: real inboxes, at an unexpected moment. Knowing the red flags on a training page isn't the same as noticing them at 4pm on a Thursday.
What paid tools add
Paid security awareness tools usually add phishing simulation (practice emails sent to your team's real inboxes), lessons triggered at the right moment, and a record of who took part and how things are trending. That record helps when an insurer or customer asks what you do about training. Our guide to Cyber Essentials and staff training explains what's worth keeping.
Before you choose one, check a few things:
- Pricing that fits a small team. Look for minimum seat counts, annual contracts and set-up fees.
- Works with your email. Google Workspace, Zoho or Microsoft 365, without weeks of IT work.
- Tone. Will your team feel coached or caught out? Blame makes people hide mistakes.
- Effort to keep running. If it needs someone to build campaigns by hand every month, it'll quietly stop.
Lureproof was built for exactly this gap. It sends practice emails at random working-hour times to teams on Google Workspace or Zoho, and anyone who clicks gets a 60-second lesson on the spot. It's free for up to five people, then £19 a month for up to 25 or £39 a month for up to 50, billed in your local currency.
How to keep it going all year
Most training starts well. It fades by month three. A simple rhythm keeps it alive without anyone having to think about it.
- Start with a baseline. Explain why you're doing it and what happens if someone clicks a practice email: a short lesson, nothing more. Then share the free test and the first few lessons.
- One practice email a month. Random times, different lures, never the same email to everyone at once.
- One topic a quarter. Five minutes at a team meeting on payments, passwords, texts or calls. Tie it to the season: tax-themed scams around the January Self Assessment deadline, parcel scams in the run-up to Christmas.
- Add it to onboarding. New starters are a favourite target because they don't yet know what normal looks like. Give them the basics in their first week.
- Celebrate reports. Thank people who report suspicious emails, real or practice. Over time, a rising number of reports tells you more than a falling number of clicks.
- Write down what you did. A short log of dates, topics and who took part is enough for most insurance and supplier questionnaires.
Above all, never use the results to blame anyone. The person who clicks a practice email today is the one you need to feel safe telling you about a real one tomorrow.
FAQ
Is security awareness training a legal requirement for UK small businesses?
There's no single UK law that says every business must train its staff. But if you handle personal data, UK GDPR expects appropriate technical and organisational measures to keep it secure, and staff awareness is a natural part of the organisational side. Many cyber insurance forms also ask about it. This is general information, not legal advice.
Does Cyber Essentials require security awareness training?
No. Cyber Essentials covers five technical controls and doesn't itself require training. Training still helps people keep those controls in place, and insurers and customers often ask about it separately.
How often should a small business run it?
Little and often works better than once a year. A sensible rhythm for a small team is a short set of basics when someone joins, one practice email a month, and a brief refresher on one topic every quarter.