Email security awareness training for small businesses: what works

Security awareness training is one of the most recommended email defenses, and one of the most misused. Done well, it turns staff into early warning sensors. Done badly, it becomes an annual video and a trap-style test that teaches people to hide mistakes. This guide covers what government guidance actually recommends, where phishing simulations help and hurt, and how to build a reporting culture in a small team.

What does effective email security training look like?

Effective training is short, specific and repeated. It focuses on the decisions staff make every day, not on memorizing threat names.

CISA's joint phishing guidance with the NSA, FBI and MS-ISAC asks organizations to "regularly educate users on identifying suspicious emails and links, not interacting with those suspicious items, and the importance of reporting instances of opening suspicious emails" (CISA). For small and medium-sized organizations, it recommends a standard anti-phishing program, annual review of training material, and a check that staff retained what they learned.

CISA's Cyber Essentials puts it in terms of culture: leaders should "develop a culture of awareness to encourage employees to make good choices online" and "learn about risks like phishing and business email compromise."

NIST's SP 800-50 Rev. 1 treats training as an ongoing learning program rather than a one-off event, with behavior change and a security culture as goals, and with metrics to show whether it's working. It's written for federal agencies but explicitly covers small organizations starting from scratch.

Why isn't training enough on its own?

The UK's National Cyber Security Centre is blunt about this. It says training, "particularly in the form of phishing simulations," is "the layer that is often over-emphasised in phishing defences," and that training packages "can't teach everyone to spot all phishing emails" (NCSC).

That's why the NCSC places training as one of four layers, alongside:

1. Making it hard for phishing to reach users: filtering and email authentication such as SPF, DKIM and DMARC.
2. Helping users identify and report phishing.
3. Limiting damage when a phish succeeds: multifactor authentication, updates and least privilege.
4. Responding quickly to incidents.

Training works best when the other layers carry most of the load. If your filter lets through a flood of junk, no amount of training will keep people alert to every message. Our small business email security checklist covers the technical layers.

What should email security training cover?

Tailor the content to what actually reaches your inboxes. A checklist to start from:

The last row matters most. Every other topic ends with "report it."

Should you run phishing simulations?

Simulations are popular, and they can help. They also carry real risks, which the NCSC calls out directly.

What simulations do well

• Show staff what realistic lures look like in their own inbox.
• Give you a reason to teach in the moment, right after a click.
• Let you practice your reporting process.

Where simulations go wrong

• They can damage trust. The NCSC warns of "unhelpful 'us vs them' scenarios that phishing simulations may engender, where staff may feel they are being tested by the security team." As an alternative, it suggests asking staff to craft their own phishing emails, which gives "a much richer view of the influence techniques used" (NCSC).
• Click rates are easy to game. A simple test gives a low rate; a hard one gives a high rate. Verizon's 2026 DBIR reports a median click rate of 1.4% for email phishing simulations, and closer to 2% for phone-centric ones such as text and voice. Verizon also cautions that the phone-centric sample was small (Verizon DBIR). Comparing your rate with a benchmark tells you little unless the tests are similar.
• Fake lures can cause real harm. A fake bonus or layoff email can upset people and spread internally as if it were real. Avoid themes that would be cruel if believed.
• Security tools may interfere. If you run a filter or gateway, test messages must be allowed through in a controlled way, and your reporting tool must recognize them.

If you run simulations, tell staff in general terms that tests happen, keep them occasional, and measure reports as well as clicks.

How do you build a reporting culture?

A culture where people report quickly is worth more than a low click rate. The NCSC's advice is direct: "Don't reprimand users who are struggling to recognise phishing emails. Users who fear reprisals will not report mistakes promptly, if at all" (NCSC).

Practical steps:

1. Make reporting one click. Microsoft provides a built-in Report button in supported versions of Outlook, and admins choose whether reports go to a reporting mailbox, to Microsoft, or both (Microsoft Learn). Google Workspace and other platforms have similar options. If you don't have a button, use one easy address.
2. Say thank you, fast. The NCSC recommends quick feedback that shows reports make a difference.
3. Welcome "I clicked" reports. These are the most valuable reports you get, because they let you reset a password or stop a payment in time.
4. Make it OK to ask out loud. Encourage people to check with a colleague before acting on an odd request.
5. Get leadership on board. The NCSC says the no-blame message needs buy-in from HR, support and senior management. When the owner reports a phish, everyone sees it's normal.

How do you change processes so phishing is easier to spot?

Training is far more effective when processes leave no room for doubt. The NCSC recommends that important email requests are "verified using a second type of communication," and that staff know the normal way key tasks, such as payments, are done (NCSC).

For a small business, that means writing down a few rules:

• Bank detail changes are confirmed by phone, using a number already on file.
• Gift card purchases are never requested by email.
• Password resets and sign-in codes are never shared with anyone, including "IT support."
• Files are shared through your normal cloud storage, not as unexpected attachments.

Tell customers and suppliers your rules too, for example "our bank details will not change by email." That gives them a chance to spot someone impersonating you.

What does a simple training plan look like for a small team?

You don't need a platform or a budget line to start. A workable first year:

1. Month 1: a 30-minute session on your verification rules and how to report, with real examples from your own inbox.
2. Every new starter: the same session in their first week, before they handle payments or customer data.
3. Every quarter: a 10-minute refresher on one theme, such as invoice fraud, QR codes or fake sign-in pages.
4. After any incident or near miss: a short, blame-free note to everyone explaining what happened and what to watch for.
5. Once a year: review the material, as CISA recommends, and check that people remember the rules, for example with a few quick questions.

Keep the people who handle money, payroll and IT administration in mind. The NCSC notes that staff who manage financial assets or administer IT systems are of greater interest to attackers and may need extra support.

How often should you train staff?

Train at onboarding, review core material at least yearly as CISA recommends, and send short updates when a new scam appears in your inbox or the news. Five minutes after a real incident ("here's what we saw last week") teaches more than an hour of generic slides. Track what you can: reports per month, time from delivery to first report, and whether payment checks were followed.

Next steps

1. Pick one reporting route, set it up, and tell everyone how to use it this week.
2. Write your three or four verification rules for payments and passwords, and include them in onboarding.
3. Review what's reaching inboxes today. A header check on a few suspicious messages shows how they got through, and our guide to how spam filters work explains the layers in front of your users.
4. Reduce the load on your people with stronger filtering. iBlockSpam's quarantine and digests are one way to keep suspicious mail out of inboxes while letting users release what they need.

Find more in our phishing and threats guides, or see our small business overview.