Phishing and cyber training
Security Awareness Training for Your Team
Most attacks on small businesses start with a convincing email, text or phone call. Practical training helps your team spot them and report them fast, from an IT team that deals with these attacks every week.
What your team learns
Spotting phishing
The signs of a fake email, text or login page, including well-written ones made with AI.
Fake invoices and bank changes
How invoice fraud works, and the simple rule that stops it: confirm any bank detail change by phone.
Impersonation and phone scams
Fake directors, suppliers and IT support, including calls using AI voice cloning.
Passwords and MFA
Password managers, why MFA matters, and never approving a sign-in request you didn't start.
Safe use of AI tools
What can and can't go into ChatGPT, Copilot and other AI tools at work.
Reporting quickly
What to do and who to tell when something looks wrong. Fast reporting limits the damage.
How we deliver it
Live team sessions
Practical, plain-English sessions on-site across London or over Teams, using examples from your industry.
New-starter induction
A short security briefing for every new joiner, so good habits start on day one.
Practice phishing emails
Safe, realistic test emails show who might need more help. Results are used for learning, never to shame anyone.
Reports for clients and insurers
A record of who was trained and when, useful when clients, insurers or auditors ask how you train staff.
Training works best alongside the right protection. See our cyber security services, or our AI training for staff.
Plan your team's training
Tell us about your team. We'll reply by email, usually within a few hours, to agree the format.
Security awareness training: common questions
Training that teaches staff to recognise and report cyber threats such as phishing emails, fake invoices and impersonation calls. Most attacks on small businesses start by tricking a person, so trained staff are one of the most effective defences.
There isn't one law requiring it for every business, but UK GDPR requires appropriate measures to protect personal data, and training staff is a common part of that. Many clients, insurers and supply chains also ask whether staff are trained.
At induction, then at least once a year, with short refreshers and occasional practice phishing emails in between. Threats change quickly, especially with AI, so little and often works better than one long session.
Safe, realistic test emails sent to staff to see who would click or enter details. Anyone who does gets a short explanation of what to look for. They're used to improve, not to catch people out.
No. Anyone with a work email or phone can be targeted, including directors, finance staff, field staff and part-timers. Directors and finance teams are often targeted most.