Security awareness training for your staff
Filters catch most scams, but the ones that get through are aimed squarely at your people. Short, regular lessons and safe practice phishing emails teach staff what a real attack looks like and what to do when they see one, without shaming anyone.
Security awareness training for small and medium businesses
Technical controls do a lot of the work, but a well-written scam email still reaches inboxes from time to time. When it does, the last line of defence is the person reading it. Staff who have seen realistic examples, and who know that reporting a mistake quickly is welcome rather than punished, stop far more attacks than staff who sat through one long presentation three years ago. Habits, not a single course, are what make the difference.
Our training is built for busy offices. Lessons are a few minutes long and arrive once a month, covering fake invoices, sign-in pages, text message scams, social media oversharing, safe file sharing and what to do with a lost laptop. Practice phishing emails go out at random times and are modelled on scams currently doing the rounds in New Zealand. Difficulty rises gradually, so staff are stretched without being set up to fail.
You get a short report each month: who completed lessons, who clicked a practice email and whether results are improving. Anyone who clicks sees a brief explanation straight away and a follow-up lesson. We look for patterns too; if one team keeps falling for delivery notices, the next lesson targets exactly that. Over time the goal is fewer clicks and more reports, because a team that reports suspicious messages quickly gives us the warning we need to block a scam for everyone else before it does harm.
What's included
Monthly micro-lessons
Short videos and quizzes on one topic at a time, sent by email so staff can complete them between tasks.
Practice phishing emails
Realistic but safe test emails sent at random, based on current scams such as courier notices, shared documents and payroll changes.
Instant teaching moments
Anyone who clicks a practice email lands on a short page explaining the warning signs they missed, rather than a telling-off.
New starter induction
Every new staff member is enrolled automatically and completes the core lessons in their first weeks.
Results by team
A simple monthly summary of completions and click rates, so managers see progress without reading through raw data.
Targeted follow-up
Teams or people who struggle with a particular type of scam get extra lessons on that type, not more of everything.
Evidence for insurers
Training records you can show an insurer, client or auditor who asks how staff are taught about cyber risk.
Who is security awareness training for?
Staff training is especially useful when:
- Your team handles payments, payroll or supplier bank details
- Someone has already clicked a scam link or entered a password on a fake page
- Your cyber insurance asks whether staff receive regular training
- You have a lot of new starters or seasonal staff
- Staff work from home and use personal phones for work email
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkSecurity awareness training questions
Will staff feel tricked or embarrassed?
We set it up to teach, not to catch people out. Results are shared with managers as team trends, and the message to staff is always that reporting quickly is the right thing to do, even after a click.
How much time does it take?
Most lessons take three to five minutes. Over a year that adds up to about an hour per person, spread so it never takes over a working day.
Is training included in a plan?
Security awareness training and phishing tests are included in the Complete plan at $169 per user per month plus GST. For other plans we can add it, with the price set out in writing first.
Do practice emails ever cause real harm?
No. The links go to a safe training page, attachments contain nothing harmful and no passwords entered are kept. We also tell your IT and finance contacts in advance so a test isn't mistaken for a real incident.
Should managers be included?
Yes. Directors and finance staff are some of the most targeted people in any office, because criminals know they can approve payments.
What should staff do if they think they clicked something real?
Tell us straight away using the report button or by email. Quick reporting lets us reset passwords and check the account before any damage is done, which is why the training stresses it.
Can we choose the topics?
Yes. There is a core set every office should cover, and we can add topics that suit your work, such as handling client personal information or using shared devices.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed ITIT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security