Most security incidents have a human step somewhere in them: a link clicked, a file opened, a payment approved on the strength of a convincing message. That's why awareness training is such a common recommendation — and why it is so often done badly. A 45-minute video watched once a year, with a quiz at the end, satisfies an auditor. It does little to help someone spot a well-crafted fake on a busy Tuesday afternoon.
Why the Annual Slideshow Fails
- It is forgotten. Knowledge fades quickly when it isn't used. A lesson in January is a distant memory by the time it is needed in September.
- It's generic. Content that isn't relevant to people's jobs doesn't stick. The finance team and the front desk face different threats.
- It treats staff as the problem. Training framed around blame produces people who hide mistakes rather than report them.
- It isn't measured. Completion rates tell you who clicked "next", not who would spot a phishing email.
What Works Instead
Short and Regular
Five-minute lessons delivered monthly beat one long session annually. Little and often keeps the subject in people's minds and fits around real work. Topics can follow the threats actually in the news, such as the rise in AI-generated phishing and voice-cloning scams.
Relevant to the Role
Give finance staff material on payment fraud and changed bank details. Give managers material on impersonation. Give everyone the basics. People engage when the examples look like their own inbox.
Simulated Phishing, Used Kindly
Sending realistic test emails shows you how the business actually behaves, and gives staff safe practice. The key is what happens afterwards. If someone clicks, the right response is a quick, friendly explanation of what to look for — not a reprimand or a league table. The aim is a falling click rate and, more importantly, a rising report rate.
Measure reporting, not just clicking. A business where staff quickly report suspicious messages is far safer than one with a low click rate and silence. Early reports let your IT provider block a campaign before anyone else falls for it.
Make Reporting Easy and Safe
Give people a one-click way to report a suspicious email, and make clear that reporting something harmless is always welcome. The worst outcome is the person who clicks, realises, and says nothing because they are embarrassed.
Back It With Real Controls
Training is a layer, not a strategy. Staff will sometimes get it wrong, so the technology around them has to limit the damage: MFA, a password manager, email filtering and sensible patching. A mistake should be survivable.
A Simple Programme for a Small Business
- Baseline. Run a first simulated phishing test to see where you are.
- Onboarding. Include security basics for every new starter, alongside your onboarding process.
- Monthly micro-lessons. Short, varied and relevant.
- Quarterly simulations. Different scenarios, with feedback.
- Targeted help. Extra support for roles that handle money or sensitive data.
- Review. Track reporting rates, repeat issues and real incidents, and adjust.
Why It Matters Beyond Security
Insurers and clients increasingly ask whether you train your staff. Frameworks such as Cyber Essentials and the expectations described in our cyber insurance guide both point the same way. A documented, ongoing programme is far easier to evidence than a certificate from a single course.
Questions worth asking internally: When did staff last receive security training, and could we show evidence? Do we know how many people would click a realistic phishing link today? Do our people know exactly how to report something suspicious, and do they feel comfortable doing it?
The Bottom Line
Good awareness training is less about knowledge than habit and culture. Keep it short, keep it relevant, treat mistakes as learning, and reward reporting. That turns your staff from the most common way in to a genuine part of your defences.