Security awareness training for UK SMEs

Security awareness training for UK SMEs should help people make safer decisions in the work they actually do. Staff need to know how to verify a payment request, share information appropriately and report a concern. They also need systems and procedures that make those actions possible.

A course completion record is useful evidence of participation. It does not prove that someone can apply the procedure under pressure, or that the business has reduced incidents. Build the programme around a small set of observable actions, then check whether people can carry them out.

Find the decisions that need attention

Start by asking staff where security gets difficult. Finance may receive urgent bank-detail changes. Customer service may need to establish a caller's identity without delaying legitimate help. Managers may approve access without knowing which permissions a role needs.

Review relevant incidents and near misses without naming or shaming individuals. Look for the point where a better process, technical control or explanation would have helped. If a shared inbox has no workable way to report a suspicious message, another video about phishing does not fix the problem.

The NCSC's engagement and training guidance recommends understanding staff workflows, tailoring training and addressing barriers to secure behaviour. It explicitly distinguishes awareness from the ability to act. Use that distinction when deciding whether the next improvement should be training, a system change or both.

Choose a few outcomes for the first cycle. For example: staff can locate the reporting route, finance verifies changed bank details through an established independent channel, and managers can explain who approves privileged access. These are clearer objectives than "increase cyber awareness".

Teach a common foundation

Everyone needs a practical introduction to accounts, devices, suspicious requests, data handling and reporting. Explain how these topics connect to the organisation's own tools and procedures.

Avoid teaching visual clues as guarantees. A polished message can be fraudulent, and a genuine message can contain a spelling mistake. Context, the requested action and independent verification matter more than a checklist that promises to identify every attack.

Show the approved password manager or account process where relevant, but never ask people to reveal passwords or recovery codes during training. Explain what to do with an unexpected MFA request. The organisation should provide a clear escalation route rather than leave the individual to guess whether to approve it.

Use a suitable introductory resource

The NCSC's Top Tips for Staff is a free introduction aimed primarily at SMEs, charities and the voluntary sector. The current resource covers strong passwords, securing devices, phishing and reporting incidents. The NCSC describes it as taking less than 30 minutes, with a short quiz and no login required for the online version.

Use it as a starting point, then add your own procedures. A general resource cannot tell an employee who answers your internal incident line or which file-sharing service your organisation approves.

Do not describe participation as organisational security certification. Nor should a training record be presented as proof that the business meets every requirement of Cyber Essentials, ISO 27001 or data protection law. Where a contract or management system requires particular competence or awareness evidence, map that requirement explicitly and retain the relevant records.

Check accessibility and working arrangements before selecting a format. Provide time to learn during work, a way to ask questions and an alternative where a delivery method does not meet someone's needs. A nominally short course can take longer when staff need language support or assistive technology.

Add role-specific practice

Finance staff need to practise handling an urgent supplier bank change without using contact details supplied in that request. Agree the approved verification and authorisation process first. Training cannot compensate for a process that allows one person to change details and release a payment without the intended checks.

Customer-facing teams need scenarios about identity checks, requests for personal information and pressure to bypass normal procedures. Define what they may disclose and when to escalate. Do not make them invent a legal judgement while a customer is waiting.

Managers need to practise approving access, handling starters and leavers, and responding constructively when someone reports a mistake. IT administrators need separate technical training appropriate to their privileges; a general staff module cannot establish competence to manage critical systems.

Senior leaders should follow the same relevant procedures. The NCSC notes that requests for special treatment can undermine the messages staff receive. If the normal process obstructs necessary work, improve it openly rather than create an informal exception that others must guess about.

Build a reporting route people can use

Publish a primary internal reporting route and a fallback if normal systems are unavailable. Say what information is helpful: the time, device or account involved, the action taken and what looked unusual. Staff should not need to prove an attack occurred before asking for help.

Tell people to report even after clicking a link, sharing information or approving an unexpected prompt. The first response should establish facts and contain the issue, not punish the act of reporting. Preserve relevant evidence and follow the incident team's instructions rather than encouraging untrained investigation.

Give the receiving team an owner and coverage arrangements. An easy reporting button has little value if nobody reviews the queue. Acknowledge reports and provide useful feedback where appropriate, so staff know that the process works.

Regulatory notification is a separate responsibility. Under the ICO's breach guidance, not every security event is a reportable personal data breach. The responsible team must assess risk and, where notification is required, notify without undue delay and within 72 hours of awareness where feasible. Staff should report internally promptly, rather than treating that deadline as permission to wait.

Practise with a safe discussion exercise

A small organisation can begin with a tabletop example rather than sending simulated attack emails. Present a fictional message on a slide or worksheet and ask participants to explain their next action using the actual procedure.

Choose a realistic decision: an apparent supplier asks for bank details to be changed before today's payment run. Ask where the employee would obtain a trusted contact number, who authorises the change and what happens if that person is unavailable. The facilitator records missing steps and impractical assumptions.

Do not collect real credentials, use sensitive personal stories or embarrass individuals. If the organisation later considers a technical simulation, define its purpose, authorisation, privacy arrangements, data handling and support process first. A simulation should help improve the service, not become a league table of staff mistakes.

There is no universal requirement to run a phishing simulation every quarter. Choose exercises and frequency from the risks, changes and learning needs. Training is one layer alongside controls such as access restrictions, secure configuration and verification procedures.

Worked example: repairing a payment process

Consider a hypothetical professional services firm. Staff can identify an unusual bank-change request in a training example, but the exercise shows that the only approved supplier contact is stored in the same email thread as the request. The advertised "independent check" is not independent in practice.

The finance owner creates a controlled supplier-contact record and defines who may update it. A deputy is appointed for absences, and the procedure explains how to stop the payment when verification cannot be completed. Staff repeat the example using the revised process.

This time, they can locate the established contact, explain the approval route and record why the change is accepted or rejected. The team has evidence that the procedure is usable in the exercise. It has not proved that fraud is impossible or measured a real-world reduction in losses.

The completed improvement is a working verification process supported by training. That is more informative than reporting a perfect quiz score while leaving the original dependency unresolved.

Measure carefully

Track participation and understanding, but distinguish them from operational outcomes. Record who was expected to complete training and the period covered, so a completion percentage has a clear denominator. Note absences, new starters and role changes rather than treating every omission as refusal.

For exercises, record the scenario, participants, assistance given and observed actions. If you compare results over time, account for changes in difficulty and audience. A lower click rate in an easier simulation does not establish that training caused an improvement.

More reports may mean greater confidence in the process, a larger volume of suspicious activity or both. Fewer reports could reflect fewer incidents or a reporting barrier. Combine counts with response times, sample quality and staff feedback before drawing conclusions.

Keep individual training information restricted to those who need it. Prefer aggregate reporting for management, with specific support offered privately where needed. Retain records according to an agreed purpose and schedule.

Set a manageable programme

Include the basics in onboarding before people take on relevant responsibilities. Follow with short, role-specific sessions and refreshers when tools, procedures or risks change. The NCSC recommends small, frequent learning and adapting it to feedback, rather than repeating the same annual material without thought.

Assign a programme owner, a business sponsor and someone responsible for correcting process problems discovered during training. Review the outstanding actions alongside participation. A training programme is incomplete if it repeatedly identifies the same unusable reporting route without fixing it.

For the first cycle, choose one risky decision, confirm the procedure, run an example and repair the gaps. Expand from there as evidence shows what staff need.

Our security consulting service can help connect awareness work to reporting, access and verification controls. Arrange a consultation with one recent near miss or a process staff find difficult. The useful outcome is an agreed action people can carry out, with an owner for any system or procedure changes it requires.