Security Awareness Training: What Works for UK Businesses

Security awareness training teaches staff to recognise and report the attacks that reach them through email, phone calls and text messages, so one rushed click does not become a breach. Done well, it is short, regular and tied to the jobs people actually do. Done badly, it is an annual slideshow that everyone forgets by lunchtime.

This guide explains what good training covers, how often to run it, how to tell whether it works, and where it stops being enough. It is written for UK business owners and IT managers who do not have a dedicated security team.

Why does security awareness training matter?

Because people are the route most attackers take. In the government’s Cyber Security Breaches Survey 2025, 43% of UK businesses reported a breach or attack in the previous 12 months. Among those that did, phishing was the most common type, hitting 85% of them.

Technical controls catch a lot, but they cannot stop an employee paying a fake invoice or reading out a verification code to a convincing caller. Someone has to notice that the request looks wrong.

The same survey shows how thin the coverage is. Only 19% of businesses had trained staff in the last 12 months. The split by size is stark: 15% of micro businesses, 34% of small ones, 54% of medium ones and 76% of large ones. If you run a small firm and have never done this, you are in the majority, but you are also an easy target.

What should security awareness training cover?

Keep the list short, because good security awareness training is focused. People remember four things better than fourteen. The NCSC’s free staff course covers why cyber security matters, how attacks happen, defending against phishing, using strong passwords, securing devices and reporting incidents. That is a sensible core for any small organisation.

Phishing and other scams

Show real examples: a fake delivery notice, a spoofed message from the managing director, an invoice with changed bank details. Cover email, but also phone calls (vishing) and text messages (smishing). Attackers move to whichever channel is least defended.

Payment and data requests

The NCSC advises that all important email requests are verified using a second type of communication, such as a phone call to a number you already hold. Make that a written rule for anything involving money, bank detail changes or sensitive data. A rule beats good judgement when someone is being rushed.

Passwords and two-step verification

Explain why a reused password is dangerous, and set up a password manager. The NCSC says any type of two-step verification is better than none, and recommends passkeys where your email provider supports them.

Devices and working away from the office

Cover screen locks, software updates, public Wi-Fi and what to do with a lost laptop or phone. Keep it practical: where to click, who to call.

How to report something

This is the most valuable item on the list. The NCSC notes that many incidents are first detected by people rather than technology. Staff need to know exactly who to tell, and that nobody will be shouted at for telling them.

How often should you run security awareness training?

More often than once a year. The NCSC’s 10 Steps guidance recommends delivering training in small, frequent chunks, and warns that reusing the same content every year signals to staff that it does not matter.

A workable pattern for security awareness training in a small business looks like this:

• Onboarding: a short session in the first week, before the new starter has a chance to be fooled.
• A baseline course: the NCSC’s free e-learning takes under 30 minutes and ends with a short quiz.
• Short refreshers: five or ten minutes each quarter on whatever scam is circulating.
• Ad hoc alerts: a quick message when a real attack lands in someone’s inbox.

The NCSC course is free, published under the Open Government Licence and can be taken in a browser or loaded into your own learning system. For a firm with no budget, that removes the excuse.

What makes training fail?

Most failures of security awareness training come from the same few habits.

• Fear. The NCSC says fear-based messaging tends to disengage people. Positive instructions about what staff can do work better.
• Blame. If the person who clicks gets a telling-off, the next person hides it. The NCSC’s phishing guidance warns against a punishment or blame-oriented culture for exactly this reason.
• Leaders who skip the rules. If a director demands an exception to the payment process, staff conclude the process is optional.
• Treating awareness as the finish line. The NCSC points out that staff may still lack the ability or technical support to change their behaviour. If the safe route is slow or awkward, people will take the quick one.

How do you know if it works?

Do not measure attendance alone. Measure behaviour. A common method is a controlled test, and our guide to running phishing simulations fairly explains how to do it without embarrassing anyone.

Track two numbers. The click rate tells you who was fooled. The report rate tells you who spotted it and said so, and the NCSC advises counting reports as well as clicks. A rising report rate is the clearest sign your training is changing behaviour.

Also watch for real-world evidence: fewer password resets after phishing, payment queries raised before money moved, and staff mentioning suspicious calls unprompted.

Is training enough on its own?

No. Security awareness training lowers the odds that someone is fooled, but it never takes them to zero, and a determined attacker only needs one success. You also need email filtering, two-step verification on every account, sensible permissions and a tested incident plan.

The only way to find out how your people and processes hold up under pressure is to try to break them. That is what social engineering penetration testing does: a tester tries the same phone calls, emails and building visits a criminal would, then reports what worked. If you want to see how staff respond before a real attacker does, our team can scope a penetration test around your own people and processes, and you can get in touch to talk it through.

Frequently asked questions

Is cyber security training a legal requirement in the UK?

I found no UK law that names training for every employee. Even so, customers, insurers and auditors often ask what you do to protect data, and staff training is one of the first answers they expect.

How long should a session be?

Short. The NCSC baseline course runs under 30 minutes, and refreshers can be much shorter. Frequent small sessions beat one long one.

Do small businesses need it?

Yes. Small teams have fewer people to catch a bad request, so each person matters more. The survey figures above show small and micro businesses train least, which is a gap worth closing.

Should we use a paid provider?

Not necessarily. Start with the free NCSC material. Buy something only if you have a clear gap, such as role-specific content for finance staff. If you do buy, the NCSC advises checking it fits your needs and works alongside your technical controls.

What if someone clicks a bad link?

Ask them to report it immediately, change any exposed passwords and tell your IT contact. Fast reporting limits the damage, so thank them for it.