Many businesses run cybersecurity training once, perhaps when someone is hired: an hour-long video, a multiple-choice quiz, a certificate. A few months later almost nobody remembers what they saw. Not because people are careless, but because that kind of training isn't designed to change habits. Anyone running a small business can do much better, often with less time and less money.
The goal: behaviour, not facts
An employee doesn't need to know how ransomware works technically. They need to know three things:
- how to recognise the risky situations typical of their job;
- what to do at that moment;
- whom to turn to, and to feel free to do so.
Every piece of training content should serve one of these three purposes. If it doesn't, it can go.
Start from the real risks of each role
The same training for everyone isn't very effective. Risks vary a lot between roles:
- accounts: bank detail change requests, fake demands from the owner, false invoices;
- sales: attachments from unknown customers, links in messages, sharing files externally;
- reception and admin: calls from fake technicians or suppliers, visitors without appointments;
- everyone: phishing, passwords, devices left unlocked, reporting anomalies.
A few minutes spent on each group's specific scenarios make the training far more concrete.
Short and frequent, not long and rare
Memory works better with frequent reminders. Instead of a two-hour annual course, consider:
- ten to fifteen minutes a month, perhaps at the start of a meeting already in the diary;
- a real example every time: a suspicious email that actually reached the company, suitably anonymised, or a case described by a supplier;
- one rule per session, repeated and put into practice.
A real example that landed in a colleague's inbox is remembered far better than ten generic slides.
Exercises: useful, if done with respect
Phishing simulations, test emails sent by the company to see who clicks, can be useful. But they become counterproductive when used to punish or embarrass. Some principles:
- announce that there will be exercises, without saying when;
- when someone clicks, immediately show them a short page explaining which signs they could have noticed;
- don't publish league tables or the names of those who got it wrong;
- measure and reward above all the reports: how many people recognised the email and reported it;
- avoid cruel simulations, such as fake cash prizes or false messages about salaries and redundancies: they damage trust without teaching anything more.
A blame-free culture
The factor that most determines an organisation's security is how quickly people report a mistake. An employee who clicked a suspicious link and says so straight away allows action within minutes. One who fears being told off stays silent, and the problem surfaces days later, when it's far more serious.
So:
- always thank whoever reports, even when it was a false alarm;
- never use reports as evidence against someone;
- share, when possible, how a report prevented a problem;
- make sure the owner sets the example first, by reporting suspicious emails too.
Make the right thing easy
Training works best when procedures support it. If the rule says bank detail changes are verified by phone, the supplier's number must be easy to find. If people are asked to report suspicious emails, there must be a button or an address that's simple to use. If people are asked not to reuse passwords, the company must provide a password manager.
A minimum programme for one year
| Month | Topic |
|---|---|
| 1 | How to report a problem, and why it pays |
| 2 | Recognising a phishing email |
| 3 | Password managers and two-step verification |
| 4 | Calls and messages from fake operators |
| 5 | Payments and bank detail changes |
| 6 | Smartphones and work devices |
| 7-12 | Refreshers with real examples received by the company, and exercises |
How to tell whether it's working
Don't count certificates. Look instead at whether:
- reports of suspicious emails and calls are increasing;
- clicks in exercises are decreasing over the months;
- people ask before doing something unusual.
In short
- Training exists to change behaviour: recognise, act, report.
- Tailor the content to the real risks of each role.
- Short, frequent sessions with real examples work better than annual courses.
- Exercises are useful only when respectful and focused on reporting.
- A blame-free culture brings mistakes to light while they can still be fixed.