Staff cyber security awareness for small teams: what it covers and how it runs

Cyber security awareness training for staff is about helping everyone in a business recognise common threats, know the business’s own rules, and report anything odd quickly. For a small team it doesn’t have to be a formal course. This guide explains what the Australian Signals Directorate’s (ASD) small business guide says awareness covers, how small teams commonly run it, and what to watch for. It’s general education, not a training program or a compliance assessment.

Why it matters

Some attacks on small businesses start with a person rather than a computer: an email that asks for a password, a call that asks for a payment, or a message that “updates” a supplier’s bank details. ASD’s small business guide says: “The best defence against email attacks is training and awareness for your employees.”

Awareness works alongside technical measures such as multi-factor authentication (MFA), updates and backups, not instead of them (see the ten small business cyber security basics).

What staff awareness covers

ASD’s small business guide describes staff knowing about:

• Common threats, including “business email compromise and ransomware”.
• How to spot scams and phishing attacks.
• The business’s own policies, such as “processes for reporting suspicious emails or for validating invoices are genuine before paying”.

business.gov.au’s cyber security checklist describes teaching staff “about common cyber threats and how to protect against them” and making sure they know how to report scams or suspected threats.

In practice, those topics usually fall into four groups.

1. Phishing and scam messages

Scamwatch lists these warning signs of phishing:

• a message claiming to be from a business you regularly deal with
• a request for urgent action
• not using your proper name
• sender details that don’t match the business or agency it claims to be from
• a website address that is slightly different to normal.

Scamwatch’s guidance is to check a contact is real by “contacting the person or organisation directly using contact details you’ve found yourself”, and not to click links or open attachments in unexpected messages. The guide to phishing, smishing and vishing explains how these attacks work by email, text and phone.

2. Payment requests and bank detail changes

ASD’s guide describes making sure staff know to be cautious of emails with “requests for payments, especially if urgent or overdue” or a “change of bank details”, and introducing “a formal process for staff to follow when payment requests are received or bank details are changed”. A 2018 Scamwatch alert on business email scams said “all businesses should firstly be aware these scams exist” and that their staff should know about them too. The payment redirection controls guide covers the invoice checks official sources describe.

3. Passwords and MFA

ASD’s small business guide describes using a password manager to “create and store unique passwords for each of your important accounts”, or a passphrase of “four or more words” that is kept unique. ASD’s MFA guide explains that MFA uses “two or more different types of actions” to confirm who is signing in, and lists email accounts as a priority, because access to email can let an attacker reset passwords elsewhere.

A useful awareness point for staff: MFA codes and passwords are never shared with anyone who asks for them. Scamwatch says never to share “passwords or one-time codes” with unexpected contacts.

4. Devices

ASD’s guide describes keeping business devices where unauthorised people can’t access them, locking them “with a passphrase, PIN or biometrics”, setting them to “automatically lock after a short time of inactivity”, and turning on automatic updates. Staff who work from home or travel may find the working from home security guide helpful.

New and AI-enabled threats

ASD’s July 2026 guidance on AI-enabled cyber attacks for small businesses suggests sharing that publication within the business “to raise their awareness of AI-enabled cyber attacks”. As scam messages become more convincing, it’s harder to judge a message by how genuine it looks. That’s why Scamwatch’s guidance focuses on checking a contact “directly using contact details you’ve found yourself”.

How to run awareness in a small team

ASD’s guide says cyber security training “isn’t a once-off requirement and should be refreshed periodically”. It doesn’t set an interval. business.gov.au describes making formal training “a part of onboarding new employees”. Within those principles, a small team can keep things light and regular.

Short, regular sessions

Awareness doesn’t have to be one long annual session. ASD’s free Exercise in a Box includes micro-exercises of 15 to 30 minutes that use role-play, and discussion-based exercises (“often called a tabletop exercise”) of 30 to 120 minutes, with the materials to run them. Other short formats that fit into an existing meeting include:

1. A quick example. Someone shares a real (but harmless) suspicious message the business received, with personal details removed, and the team talks through the warning signs.
2. A current warning. Scamwatch publishes news alerts about current scams; reading one together keeps the topic fresh.
3. A policy reminder. A two-minute recap of one rule, such as how bank detail changes are verified.
4. Practice. Our phishing awareness quiz has example messages to work through as a group or individually.

A simple reporting channel

ASD’s emergency plan asks: “What is the process for your staff to report potential cyber security incidents?” For a small team, the answer is often one named person and one simple method, for example:

• forward suspicious emails to a nominated person, or
• call or message that person directly if email itself might be affected.

The aim is that reporting is quick and blame-free, so people report early, including when they’ve already clicked something. The one-page cyber incident response plan has a section for recording how staff report an incident.

Onboarding and offboarding

business.gov.au describes cyber security as part of onboarding. ASD’s guide also notes that “unless you change the password, employees could also continue accessing accounts even after they have left the business”, so the end of employment matters too. Both points can sit in a short security policy for small teams.

A fictional example

Mia runs a five-person bookkeeping practice. At a Monday meeting, she shares an email the team received from “accounts@supp1ier-invoices.example” asking them to update a supplier’s bank details before paying. The team spots the extra “1” in the address and the urgent tone. Mia reminds everyone of the business’s rule: bank detail changes are confirmed by phone, using the number already on file. She then asks each person to try the phishing quiz that week. The session takes ten minutes.

Things to watch for

• Training as a substitute for settings. Awareness helps, but ASD’s guide lists MFA, updates and backups as separate measures. A message that looks perfect can still be fake.
• Blame. If people fear getting in trouble, they may not report a mistake. Early reporting gives the business the most options.
• Only covering email. Scamwatch describes phishing by email, text and phone calls. Payment fraud can also come by phone.
• Simulated phishing tests. Some businesses send staff simulated phishing emails. How these are run is a workplace decision; a test that feels like a trap can work against the blame-free reporting described above.
• Sharing too much in examples. When using a real suspicious message, removing customer and staff personal details protects privacy.
• Out-of-date content. Scams change. Scamwatch’s alerts and ASD’s publications are updated over time.

Common questions

How do I train my staff in cyber security?

For a small team, it doesn’t have to be a formal course. ASD’s small business guide describes staff knowing about common threats, how to spot scams and phishing, and the business’s own policies, and business.gov.au describes making formal training part of onboarding. Short sessions in existing meetings are one option, including the 15 to 30 minute micro-exercises in ASD’s free Exercise in a Box. See how to run awareness in a small team.

What does staff cyber security awareness training cover?

ASD’s small business guide describes common threats such as business email compromise and ransomware, how to spot scams and phishing, and the business’s own policies, such as reporting suspicious emails and validating invoices before paying. business.gov.au describes making sure staff know how to report scams or suspected threats. Passwords, MFA and device security are also covered in ASD’s guide. See what staff awareness covers.

How often do staff need cyber security training?

ASD’s guide says training “isn’t a once-off requirement and should be refreshed periodically”, but doesn’t give a specific interval. business.gov.au describes making it part of onboarding. ASD’s Exercise in a Box includes short micro-exercises of 15 to 30 minutes that can be run as often as a business wants. See short, regular sessions.

How do my staff report a suspicious email?

Each business sets its own process. ASD’s emergency plan asks: “What is the process for your staff to report potential cyber security incidents?” For a small team, the answer is often one named person and one simple method, such as forwarding suspicious emails to that person, or calling them if email itself might be affected. See a simple reporting channel.

What do I do if a staff member clicks a phishing link?

Under the approach described here, the staff member reports it straight away to the business’s nominated person. The reporting channel is meant to be quick and blame-free, so people report early, including when they’ve already clicked something; early reporting gives the business the most options. The one-page cyber incident response plan covers who to contact and the first actions official sources describe, and where to report scams and cybercrime explains Scamwatch and ReportCyber.

Is security awareness training enough to protect a small business?

Not on its own, in ASD’s framing. ASD’s guide treats awareness as one of several basics, alongside MFA, software updates, backups and access controls. A message that looks perfect can still be fake, and no single measure prevents every attack. See things to watch for and the ten small business cyber security basics.

Where to get official help

• ASD’s small business cyber security guide covers staff training and the other basics.
• business.gov.au’s cyber security checklist lists free government tools and services.
• The Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), is listed by business.gov.au for help preparing for and responding to incidents.
• Where to report scams and cybercrime in Australia explains Scamwatch and ReportCyber.