# What security training does a small team need? Start with real decisions. > Choose practical training around phishing, access requests and AI tools. Give a small team clear next steps, a person to tell and a routine it can keep. Page: https://cybee.ai/blog/security-training-small-team/ (Security awareness training: a small team checklist) - [Blog](https://cybee.ai/blog/) - Security training your team A payment change that seems to come from a client. An AI tool that wants the whole Drive. Good training is built around moments like these, and every lesson ends with a next step and a person to tell. By [cybee](https://cybee.ai/about/#founders) Published 21.09.2026 Updated 24.09.2026 7 minute read In one minute - Teach the decisions your team really makes: an odd request, a sign in, a shared file, a new AI tool, a mistake. - Build each lesson around a moment from a normal workday, and end it with the next step: who to call, what to check. - AI tools belong in the lessons now. A convincing answer from an assistant is not permission to act. - Give new people the basics before they get client access. Add short refreshers when something changes. - Record who took part, and check understanding separately. Finishing a lesson is not the same as knowing what to do. ## What should security training cover for a small business? Teach the decisions your team actually makes: checking an unusual request, protecting sign ins, sharing client files, connecting AI tools and reporting a mistake quickly. Use short examples from their own work, and name one person to contact. Record who took part. Then practise the same decisions again when the work or the tools change. **Q:** What is phishing? ### What phishing is. A message that pretends to come from someone you trust, such as a client, a supplier or your own bank. It wants you to click a link, pay an invoice or type a password. Most of it arrives by email. The same trick also turns up in chats, text messages and shared documents. The defence is a habit: check through a route you already know before you act. ## Begin with a moment from a normal workday. A client seems to ask for a change to their payment details. An assistant asks for access to an entire Drive. A freelancer wants to send project files to a personal account. People at an agency will recognise each of these. A lesson built around them gives people something to do. A slide full of threat terms usually does not. So choose examples for the roles in your team. designers ### File links and browser tools. Who a sharing link reaches, and what a browser extension can read. developers ### Keys, packages and agents. Clear rules for secrets, for the code they pull in and for what an agent may change. account managers ### Unusual client requests. How to check a surprising request through a route they already know. For everyone One simple route for asking for help and reporting a mistake. Name the person, and the channel people use to reach them. ## Show the next step, not only the warning sign. It is easy to tell someone to be careful. Be specific about what they should do instead. For a surprising payment request, contact the client through a route you already know. For a new app permission, check what access it really needs before you approve it. For a file shared by mistake, report the details quickly, so the right person can act. Use a made up example based on a real workflow, with no live client information in it. Ask the team what they would do next. A good answer names a person, a channel or a check they can run. If people know the warning signs and still do not know who to tell, the lesson is not finished yet. 1 2 3 Figure: One lesson, three steps. The last one names a person. Provider guidance: [NCSC (United Kingdom): spotting cyber attacks](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/spotting-cyber-attacks) ## Include the tools your team uses now. AI assistants bring familiar questions into a new setting. What may I share? What can this tool reach? Which action needs a yes first? Show how a useful connector can ask for more access than the task needs. And make it clear that a convincing answer from an assistant is no proof that an action is allowed or safe. Keep these lessons practical. A copywriter can practise picking a harmless example instead of an unpublished client brief. A developer can compare read only access with a tool that may change live data. Do not assume everyone uses the same assistant, or that one general rule replaces what a client requires for their own information. **Q:** What is an AI connector? ### What an AI connector is. A connection that lets an AI assistant use another tool: a Drive, a project tracker, a client’s website. Most use MCP, the open standard that lets an AI assistant use a tool. Each connector is access. It stays in place until someone removes it. [Is it safe to connect this tool to your AI assistant?](https://cybee.ai/blog/mcp-server-security/) **Q:** What counts as a secret? ### What counts as a secret. Anything that lets someone act as you or as your client: passwords, keys, tokens, recovery codes. They belong in a password manager. Never paste them into a chat with an assistant, a shared document or a code repository. ## Build a small routine the team will keep. Give new people the basics before they get access to client work. Follow up with short refreshers tied to a change: a new tool, a new client requirement or a mistake worth learning from. Plan them as work. Asking people to finish training in their spare time tells them the business does not think it matters. Keep a record of who completed what. Just do not confuse completion with understanding. Go back to a scenario in a team meeting and see whether people can name the next step. Welcome early reports, and never shame anyone in public. When someone raises something they are unsure about, thank them and sort it out. That response teaches the team as much as any course. Figure: A completion record: names, lessons, dates. It shows who took part, not what they will do next time. Provider guidance: [NCSC (United Kingdom): free security training for staff](https://www.ncsc.gov.uk/information/top-tips-for-staff) ## Connect training with the rest of your security work. cybee includes security training in the Proof plan: short lessons on topics such as a lost laptop, AI tools, secrets and permissions. You assign them from your AI assistant in one sentence, and each finished lesson is recorded next to the protection and security work your team already does. The cybee icon in the Mac’s menu bar shows each person the training that is due, so nobody has to open yet another app. When a client asks for proof of training, use the completion record, and say who and what it covers. The Trust Passport for your Macs is a different record, and it does not prove that every training or policy requirement is met. Training pays off when people make the next decision well, and the business can show what it actually provided. Figure: One icon in the menu bar. The lesson waits there until Mira has a moment. **Q:** Does a finished lesson prove my team is safe? ### What a finished lesson shows. It shows that a person finished a lesson, and when. It does not certify your company, and it does not promise what anyone decides the next time an odd request arrives. That is why the record sits next to the conversations in your team meetings, not in place of them. Proof plan Security training is part of the Proof plan: CHF 9 per Mac per month, or 90 a year, excluding tax. To try it for 14 days, install cybee and ask your AI assistant for security training. The Stripe link arrives in the chat. Protection and the 118 checks stay free on every Mac. [Security training for your team](https://cybee.ai/product/training/)[A freelancer leaves. What access do you remove?](https://cybee.ai/blog/contractor-offboarding-checklist/) ## What to remember. - Use the situations your people face in client work. - End every lesson with a clear next step. - Keep the record of who took part, and check understanding separately. ## Sources and further reading. - [NCSC (United Kingdom): free security training for staff](https://www.ncsc.gov.uk/information/top-tips-for-staff) - [NCSC (United Kingdom): spotting cyber attacks](https://www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/spotting-cyber-attacks) Product scope and provider guidance can change. Check the linked source for your own setup. Stuck on a word? [Look it up in the security glossary](https://cybee.ai/glossary/). ## Put it to work. Short lessons, assigned from your AI assistant in one sentence, with a record of who finished. [See how training works](https://cybee.ai/product/training/) On this page - The short answer - A moment from a workday - Show the next step - The tools your team uses - A routine that lasts - Connect it to the rest - What to remember - Sources cybee Short security lessons for your team, with a record of who finished. Part of the Proof plan. [See how it works](https://cybee.ai/product/training/) ## People change, tools change. Three more guides. [your team A freelancer leaves. What access do you remove? A checklist for agencies: accounts, shared files, AI connections, client keys and the handover record. Read the guide](https://cybee.ai/blog/contractor-offboarding-checklist/) [AI tools Is it safe to connect this tool to your AI assistant? Five checks before an AI assistant gets access to client files, a database or another business tool. Read the guide](https://cybee.ai/blog/mcp-server-security/) [your team Who still has your client’s API keys? Keys in scripts, automations or AI tools at a handover: what to keep, what to replace and what to remove. Read the guide](https://cybee.ai/blog/client-api-key-handover/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)