Ask your team what they remember from the last cyber security training they sat through. If the honest answer is “a quiz and a certificate”, you’re not alone.

Most businesses know staff training matters, because so many incidents begin with an everyday click. The problem is that a lot of training is built to tick a box rather than change what people do. Here’s how to make it count.

Why Most Training Doesn’t Stick

• It happens once a year. People forget most of it within weeks.
• It’s generic. A finance assistant and a site engineer face different risks, but get the same slides.
• It’s long and dry. Forty minutes of clicking “next” isn’t learning.
• It’s measured by completion. A 100% pass rate says people finished, not that anything changed.

None of that is a criticism of staff. It’s a design problem, and it’s fixable.

What Good Training Looks Like

Short and regular. Ten minutes now and then beats an annual marathon. Little and often is what builds habits.

Relevant to the job. Use examples people will recognise, such as fake invoices for finance or fake delivery notices for reception.

Teaches, doesn’t punish. Practice phishing emails are most useful when they help people learn. If someone is embarrassed for clicking, they stop reporting, which is the opposite of what you want.

Makes reporting easy. The best sign of a healthy security culture is staff who flag something odd quickly and without worrying about blame.

Backed by leadership. When managers take part, everyone else treats it as important.

Measured by behaviour. Look at how many people report suspicious emails and how quickly, not just who finished the course.

What to Cover First

You don’t need to teach everything at once. Start with the things that cause the most trouble:

1. Spotting phishing and fake requests, including texts, calls and invoices that ask for money or details.
2. Passwords and logins, including why multi-factor authentication and a password manager make life easier, not harder.
3. Working safely away from the office, from public Wi-Fi to shared devices.
4. What to do when something looks wrong, and who to tell.

These line up with the tricks hackers use most.

How to Get Started

1. Pick your top three risks based on how your business actually works.
2. Choose a regular rhythm, such as a short session or reminder each month.
3. Set up a simple, no-blame way to report anything suspicious.
4. Check what’s changing, such as reports coming in sooner and fewer risky clicks.

If you want a free starting point, the NCSC’s small business guide is a good one.

The Bottom Line

Training works when it’s short, relevant and regular, and when people feel safe speaking up. It sits alongside fixing the basics first, not instead of it, because the best awareness in the world helps most when the right protections are already in place.

If you’d like help building awareness training that your team will actually use, explore our cybersecurity solutions or get in touch with the team at Gardner Systems.