What is cyber awareness training?

Evidence from phishing simulation programmes consistently shows that regular training reduces click rates on simulated attacks and, more importantly, increases the rate at which staff report suspicious messages. That matters because the majority of breaches affecting small organisations begin with a person — a clicked link, a credential entered on a fake login page, or a fraudulent payment request actioned without verification. Training does not eliminate the risk, and it should never be the only control; multi-factor authentication, email filtering and endpoint protection remain necessary. What it does is shorten detection time and reduce the number of incidents that reach a technical control at all.

Short modules delivered monthly or quarterly work better than a single annual session, because recognition of attack patterns decays within weeks without reinforcement. A common pattern is a short baseline module during onboarding, followed by five to ten minute refreshers on a rotating set of topics, with simulated phishing running continuously in the background at varying difficulty. Annual training is often enough to satisfy a compliance checkbox but rarely changes behaviour measurably. Staff in higher-risk roles — finance, payroll, executive assistants, anyone who can move money or change bank details — benefit from additional targeted content.

Awareness training is normally priced per user per month, and for SMEs typically falls between a few pounds and around ten pounds per user monthly, depending on whether phishing simulation, policy management and reporting are bundled. A twenty-person business is therefore usually looking at a low hundreds of pounds per year rather than a major capital cost. Free material is available from the NCSC and is worth using, though it lacks per-user tracking and simulation reporting, which is what most organisations need to evidence the control for insurers, auditors or certification.

Cyber Essentials assesses five technical controls and does not include a dedicated staff training requirement, so training is not strictly mandatory for certification. However, several of the technical requirements — password practice, account handling, recognising when software is unsupported — depend on staff behaviour to hold in practice. Other frameworks are more explicit: ISO 27001 requires awareness, education and training as a formal control, and UK GDPR accountability obligations effectively require organisations to demonstrate staff understand how to handle personal data. Insurers frequently ask about training during underwriting as well.

Aggregate results are useful for managers and boards: overall click rates, report rates and trends by department show whether the programme is working and where additional support is needed. Individual results are more sensitive. Programmes that name and penalise individuals tend to reduce reporting, because staff become reluctant to admit mistakes — and rapid reporting is precisely the behaviour that limits damage during a real incident. The more effective approach is to route repeat clickers into short additional training automatically, keep individual data confidential, and publicly recognise reporting rather than punishing clicking.