Most successful attacks on small businesses start with a person: a convincing email, a fake invoice, a phone call from “IT”. Technical controls catch a lot, but staff are the last line of defence. Good awareness training is not a one-off video at induction. It is short, regular and relevant to the jobs people actually do.
Start with the free basics
Start with a short baseline session for everyone, including the directors. It should cover strong passwords, securing devices, defending against phishing and reporting incidents.
What a good programme covers
- Phishing: how to spot suspicious emails, texts and messages, and what to do with them.
- Payment and invoice fraud: verifying changes to bank details by phone using a known number, never the one in the email. This matters most for finance staff.
- Passwords and multi-factor authentication: why approving an unexpected sign-in prompt is dangerous.
- Phone and impersonation scams: callers pretending to be IT support, the bank or a supplier. See how to spot tech support scams.
- Handling data: sharing files safely, and what counts as a data breach.
- Reporting: who to tell, how, and reassurance that reporting a mistake quickly is always the right thing to do.
Make reporting easy
Give staff one simple way to report something suspicious, such as a button in Outlook or a named person. Suspicious emails can also be forwarded to the UK’s official scam email reporting address, report@phishing.gov.uk. The goal is that people report quickly, not that they never make mistakes.
Phishing simulations, done fairly
Simulated phishing emails can show where training is working, but they backfire if they are used to catch people out or name and shame. Use realistic but fair scenarios, give immediate, friendly feedback, and measure how many people report the email, not just how many click.
How often?
- Induction training for every new starter, before they get full access.
- Short refreshers through the year, rather than one long annual session.
- Extra, role-specific sessions for finance, HR and anyone with admin access.
- A quick briefing whenever a new scam is doing the rounds.
Back training up with technical controls
Training reduces risk; it does not remove it. Combine it with multi-factor authentication, email filtering and endpoint protection. Our posts on zero-click phishing and whether attackers can get past MFA explain why.
When to speak to BMT
Our cyber awareness training gives your team short, practical sessions and fair phishing simulations, with reports you can use for Cyber Essentials and insurance renewals. Call us on 0161 672 7461 or 01706 391 047, or get in touch online.
Related reading
Spam and ham: a guide to email security · Cyber security packages: who responds to alerts? · Cyber awareness training