What security training does a small team need? Start with real decisions.

What should security training cover for a small business?

Teach the decisions your team actually makes: checking an unusual request, protecting sign ins, sharing client files, connecting AI tools and reporting a mistake quickly. Use short examples from their own work, and name one person to contact.

Record who took part. Then practise the same decisions again when the work or the tools change.

Begin with a moment from a normal workday.

A client seems to ask for a change to their payment details. An assistant asks for access to an entire Drive. A freelancer wants to send project files to a personal account. People at an agency will recognise each of these. A lesson built around them gives people something to do. A slide full of threat terms usually does not.

So choose examples for the roles in your team.

Show the next step, not only the warning sign.

It is easy to tell someone to be careful. Be specific about what they should do instead. For a surprising payment request, contact the client through a route you already know. For a new app permission, check what access it really needs before you approve it. For a file shared by mistake, report the details quickly, so the right person can act.

Use a made up example based on a real workflow, with no live client information in it. Ask the team what they would do next. A good answer names a person, a channel or a check they can run. If people know the warning signs and still do not know who to tell, the lesson is not finished yet.

Include the tools your team uses now.

AI assistants bring familiar questions into a new setting. What may I share? What can this tool reach? Which action needs a yes first? Show how a useful connector can ask for more access than the task needs. And make it clear that a convincing answer from an assistant is no proof that an action is allowed or safe.

Keep these lessons practical. A copywriter can practise picking a harmless example instead of an unpublished client brief. A developer can compare read only access with a tool that may change live data. Do not assume everyone uses the same assistant, or that one general rule replaces what a client requires for their own information.

Build a small routine the team will keep.

Give new people the basics before they get access to client work. Follow up with short refreshers tied to a change: a new tool, a new client requirement or a mistake worth learning from. Plan them as work. Asking people to finish training in their spare time tells them the business does not think it matters.

Keep a record of who completed what. Just do not confuse completion with understanding. Go back to a scenario in a team meeting and see whether people can name the next step. Welcome early reports, and never shame anyone in public. When someone raises something they are unsure about, thank them and sort it out. That response teaches the team as much as any course.

Connect training with the rest of your security work.

cybee includes security training in the Proof plan: short lessons on topics such as a lost laptop, AI tools, secrets and permissions. You assign them from your AI assistant in one sentence, and each finished lesson is recorded next to the protection and security work your team already does. The cybee icon in the Mac’s menu bar shows each person the training that is due, so nobody has to open yet another app.

When a client asks for proof of training, use the completion record, and say who and what it covers. The Trust Passport for your Macs is a different record, and it does not prove that every training or policy requirement is met. Training pays off when people make the next decision well, and the business can show what it actually provided.

What to remember.

• Use the situations your people face in client work.
• End every lesson with a clear next step.
• Keep the record of who took part, and check understanding separately.

Sources and further reading.

• NCSC (United Kingdom): free security training for staff
• NCSC (United Kingdom): spotting cyber attacks

Product scope and provider guidance can change. Check the linked source for your own setup. Stuck on a word? Look it up in the security glossary.