Cyber Security Awareness Training for Employees: A UK Guide
A good cyber security awareness programme teaches every employee a small set of habits that stop the most common attacks: spotting and reporting phishing, using strong passwords with 2-step verification, handling data safely, working securely away from the office, and knowing exactly who to tell when something goes wrong. It works best as short, frequent, role-relevant sessions backed by leaders, and you judge it by how people behave (especially how quickly they report), not by how many completed a course.
This guide is for UK managers, HR leads and IT leads in organisations of any size who need to build or fix a staff training programme. It draws on the government’s latest Cyber Security Breaches Survey and free guidance from the National Cyber Security Centre (NCSC) and the Information Commissioner’s Office (ICO).
Why staff training still matters in 2026
The Cyber Security Breaches Survey 2025/2026, commissioned by the Department for Science, Innovation and Technology and the Home Office and published on GOV.UK on 30 April 2026, found that 43% of UK businesses and 28% of charities reported a cyber security breach or attack in the previous 12 months. Phishing was by far the most common type, experienced by 38% of businesses and 25% of charities, and it was also the type most often named as the most disruptive.
Yet only around a fifth of businesses (19%) and charities (17%) had run any staff training or awareness raising in the last 12 months. Size makes a big difference: 54% of medium businesses and 84% of large businesses had done so. Among businesses that identified a breach or attack, the most common follow-up action was people or training changes (31%).
The survey’s interviews add useful colour: larger organisations tended to focus on continuous training, smaller ones tended to train people when they joined and then stop, and organisations across the board found it hard to get staff to believe security mattered. A programme has to solve that buy-in problem, not just deliver content.
What a good programme covers
Start with the behaviours you need, not a catalogue of topics. The NCSC advises organisations to “understand and prioritise the cyber security knowledge and behaviours that individuals in your organisation need before developing or procuring any training solutions” (10 Steps: Engagement and training). For most organisations the core looks like this:
| Topic | What staff should be able to do |
|---|---|
| Phishing and social engineering | Recognise common warning signs, pause on urgent requests for money, passwords or data, and verify unusual requests through a second channel such as a phone call. |
| Passwords and 2-step verification | Use a strong, separate password for email, use a password manager where the organisation provides one, and switch on 2-step verification (also called multi-factor authentication). |
| Reporting incidents | Know the one place to report a suspicious message, a lost device or a mistaken click, and report quickly without fear of blame. |
| Data handling | Apply the organisation’s rules for sharing, storing and disposing of personal and confidential information, and recognise a personal data breach. |
| Remote and hybrid working | Keep devices locked and updated, use approved tools and connections, and take care with conversations and screens in public places. |
A few points of detail are worth getting right:
- Passwords. NCSC public guidance suggests combining three random words to make a password that is long enough and strong enough, and encourages people to use password managers and to turn on 2-step verification for email.
- Verification of requests. The NCSC’s phishing guidance recommends making processes more resistant to phishing by verifying important email requests through a second type of communication, and making sure staff know the normal way key tasks (such as payments) are done, so unusual requests stand out.
- External reporting. Staff can forward suspicious emails to the NCSC at [email protected]. Your internal reporting route should still come first, so your own team sees what is arriving.
Then add role-based layers. The NCSC notes that staff who handle sensitive information, manage financial assets or administer IT systems are of greater interest to attackers and may face targeted spear phishing. Finance, HR, executive assistants and IT administrators usually need deeper, scenario-based sessions than the all-staff baseline.
Formats and frequency
The single most useful design rule comes from the NCSC: “Deliver training in small, frequent chunks. Consistent small messages are more digestible and more effective than an hour session once a year.” The same guidance warns that using the same training video year after year tells staff that little importance is placed on it.
A practical mix for most organisations:
- Induction. A short baseline module before or as soon as people get system access. For data protection, the ICO’s accountability toolkit expects induction training for all staff before they access personal information and within one month of their start date. (The ICO notes that this guidance is under review following the Data (Use and Access) Act.)
- Short refreshers through the year. Five to ten minute modules, team briefings or intranet posts tied to real threats your organisation is seeing. The ICO toolkit expects refresher training “at appropriate intervals” and says it should reach all staff regardless of how long they will be working for you, their contractual status or grade.
- Live, interactive sessions for higher-risk roles. Workshops built around your own processes, such as a payment change request or a request to share a file externally.
- Exercises. Tabletop discussions where a team talks through how it would respond to an incident. These build the reporting and escalation muscle that e-learning cannot.
Leaders matter as much as format. The NCSC asks senior leaders to lead by example, because executives who ignore policies or ask for special treatment signal to everyone else that it is acceptable to bypass policies. It also advises using positive messages about what staff can do, noting that fear-based messaging can leave people disengaged.
How to measure whether it works
Completion rates show that training was delivered, not that it changed anything. The NCSC is blunt about this: “awareness is only the first step”, and making people aware of risks does not mean they will act on them. It also advises allowing enough time to pass before judging the impact of awareness work.
Better measures look at behaviour:
| Measure | What it tells you |
|---|---|
| Number of suspicious messages reported by staff | Whether people use the reporting route at all. |
| Time from a suspicious message arriving to the first report | How early your human “sensors” raise the alarm. |
| Self-reported mistakes (for example, “I clicked” reports) | Whether people trust that reporting will not get them punished. |
| Payment or data requests verified by a second channel | Whether the key process change is actually used. |
| Short knowledge checks and staff feedback | Which topics are unclear and which modules feel irrelevant. |
If you run phishing simulations, read the NCSC’s caution first. Its guidance says no training package can teach users to spot every phishing attempt, that punishing people for clicking on emails you sent “starts to resemble entrapment”, and that you should always check with HR before running simulations. It suggests that, as well as measuring how many people clicked, you “focus on how many people reported it”.
Boards are expected to ask about this too. The government’s Cyber Governance Code of Practice (published 8 April 2025) asks directors to “gain assurance, using suitable metrics, that the organisation has an effective cyber security training, education and awareness programme”. Pick metrics you would be comfortable presenting to them.
Common mistakes to avoid
- Blaming people who click. The NCSC says users who fear reprisals will not report mistakes promptly, if at all. A no-blame reporting culture is what turns staff into an early warning system.
- Relying on training alone. The NCSC describes user education as just one layer of phishing defence, alongside email filtering, device protection and fast incident response. The NCSC says technological, process and people-based measures must all be considered for defences to be really effective.
- One annual video for everyone. It is easy to buy and easy to report, but the NCSC warns against both the once-a-year session and reusing the same video year after year.
- Generic content. The NCSC says irrelevant or unachievable messages will not have the desired results, and that if people need workarounds to get their jobs done, more awareness will not help until the underlying issue is fixed. Listen to staff and fix the process.
- Forgetting temporary and short-term staff. The ICO expects induction and refresher training for all staff, regardless of how long they will be with you, their contractual status or grade.
- Leaders opting out. If executives skip the training or ignore the rules, staff notice.
Free official resources to build on
Before paying for anything, look at what UK government bodies already provide free of charge:
- NCSC Top Tips for Staff. A free e-learning package that takes less than 30 minutes and covers strong passwords, securing devices, defending against phishing and reporting incidents. Staff can use it online with no login, or you can download SCORM files to load into your own learning platform. There is a Welsh version, and the English version meets WCAG 2.1 (Level AA) accessibility guidelines.
- NCSC Exercise in a Box. A free resource for rehearsing your response to cyber attacks, with 20 exercises across 12 topics, including short micro exercises and tabletop discussion exercises on themes such as ransomware and phishing.
- NCSC 10 Steps: Engagement and training. Short, practical guidance on designing awareness campaigns and training that people will actually engage with.
- NCSC Phishing attacks: defending your organisation. The layered approach to phishing, including how to approach training and reporting culture.
- ICO training and awareness toolkit. What the regulator expects from data protection training, including induction, refreshers, specialist roles and record keeping.
For example, imagine a 200-person firm with no programme today. It could use Top Tips for Staff as its induction baseline, add a monthly five-minute update on threats it has actually seen, run one Exercise in a Box tabletop with its leadership team, and track staff reports of suspicious messages from the first month.
When to bring in outside help
Free resources cover the baseline well. Organisations often look for outside help when they need content tailored to their own processes and regulators, live sessions for high-risk teams, or a way to connect awareness work to board reporting. Testing how people and processes hold up under realistic attack is a different job again; our post on whether your company needs a red team explains where that fits.
LSCS designs enterprise training around an organisation’s risk profile and cyber security maturity, including cross-functional cyber awareness programmes and role-based training for management and GRC teams. For directors, the Board Governance of Cybersecurity course covers oversight of cyber risk. If you would like to talk through your programme, book a consultation.
Frequently asked questions
How often should employees have cyber security awareness training?
Train new starters at induction, then use short, frequent refreshers through the year. The NCSC says small, consistent messages are more effective than an hour-long session once a year.
Is cyber security training for employees a legal requirement in the UK?
UK GDPR requires appropriate security for personal data, and the ICO’s accountability toolkit expects induction and refresher data protection training for all staff, linking poor training to articles 5(1)(f) and 32. Sector regulators may set further expectations.
Is there free cyber security training for staff in the UK?
Yes. The NCSC’s Top Tips for Staff is a free e-learning package that takes under 30 minutes, and NCSC Exercise in a Box offers free incident response exercises.
Do phishing simulations work?
They can play a part, but the NCSC warns that no training can teach people to spot every phishing email and that punishing clicks damages trust. Measure how many people report a simulated phish, not just how many click, and agree the approach with HR first.
How do you measure security awareness training effectiveness?
Look at behaviour rather than completion rates: how many suspicious messages staff report, how quickly they report, whether people own up to mistakes, and whether key processes such as payment verification are followed.
References
- Department for Science, Innovation and Technology and Home Office (2026). Cyber security breaches survey 2025/2026. Published on GOV.UK, 30 April 2026. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- National Cyber Security Centre (2021). 10 Steps to Cyber Security: Engagement and training. https://www.ncsc.gov.uk/collection/10-steps/engagement-and-training
- National Cyber Security Centre (2018, reviewed 2024). Phishing attacks: defending your organisation. https://www.ncsc.gov.uk/guidance/phishing
- National Cyber Security Centre (2025). Top Tips for Staff: help your staff keep your organisation safe online. https://www.ncsc.gov.uk/information/top-tips-for-staff
- National Cyber Security Centre. Exercise in a Box. https://www.ncsc.gov.uk/section/exercise-in-a-box/overview
- National Cyber Security Centre (2021, reviewed 2022). Report a scam email. https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email
- National Cyber Security Centre (2021). Top tips for staying secure online: Three random words. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words
- National Cyber Security Centre (2018, reviewed 2021). Use a strong and separate password for email. https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email
- Department for Science, Innovation and Technology, NCSC and DCMS (2025). Cyber Governance Code of Practice. https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
- Information Commissioner’s Office. Data protection audit framework: Training and awareness. https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/accountability/training-and-awareness/
Stay Ahead With LSCS
Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.