Most cyber incidents in South Australian small businesses, not-for-profits and councils still begin with a person being tricked: a convincing email asking someone to sign in, a supplier “changing bank details”, a text message about a parcel, or a phone call from someone claiming to be IT support. Technical controls stop a lot of this, but not all of it, so staff need to know what to look for and, just as importantly, feel safe reporting a mistake straight away. This guide sets out a practical security awareness program that fits a small team: what to cover, who needs more, how to run fair phishing tests, and a 90-day plan. It is general guidance, not legal or insurance advice, and products and threats change, so check current details before you rely on them.
Why training still matters when you have good security tools
- Some attacks contain nothing to block. A fake invoice or a request to change a supplier’s bank account can come from a real but compromised email account, with no link or attachment for a filter to catch.
- Attackers use more than email. Text messages, QR codes, Teams or chat messages, phone calls and, increasingly, AI-generated voices and videos are all used to pressure staff.
- Fast reporting limits the damage. A person who reports a suspicious sign-in within minutes lets you reset a password and revoke sessions before an attacker gets far. Our incident response plan guide explains what happens next.
- Insurers and buyers ask about it. Cyber insurance questionnaires and many government and council supplier questionnaires ask whether staff receive regular security training and how you record it. See our cyber insurance questionnaire guide.
Training works best alongside controls that make mistakes less costly: multi-factor authentication, email authentication and filtering, and payment checks that do not rely on one person spotting a fake. Our guides to rolling out MFA and a password manager and SPF, DKIM and DMARC cover those.
The core topics every staff member needs
- Spotting phishing. Unexpected urgency, a sign-in page reached from a link, a sender address that is nearly right, an attachment you did not expect, or a request to keep something quiet. The safe habit is to go to the website or app directly rather than through the link.
- Fake invoices and bank detail changes. Never change payment details based on an email alone. Call the supplier on a number you already hold, not one in the message, and require a second person to approve changes.
- Sign-in prompts and MFA requests. Never approve a sign-in request you did not start, and never read a code out to someone who calls you. Repeated prompts are a warning sign, not an annoyance to clear.
- Phone, text and chat scams. Callers pretending to be IT support, a bank, a government agency or the boss. Hang up and call back through a known number.
- Passwords and devices. Use the business password manager, lock screens, keep devices updated and report a lost laptop or phone the same day. Our laptop and phone management guide covers the technical side.
- Handling personal and sensitive information. Where it may be stored and shared, what not to send by email, and what not to paste into public AI tools. Our generative AI acceptable use policy guide covers the AI side.
- How to report, and that reporting is welcome. One simple way to report, such as the Report button in Outlook or a single named contact, and a clear message that nobody is punished for reporting, even after clicking.
Extra training for higher-risk roles
| Role | What to add |
|---|---|
| Finance and accounts payable | Bank detail change procedure, call-back checks, payment approval limits, and examples of real fake-invoice and impersonation emails. |
| Managers, executives and elected members | Impersonation of senior people, urgent payment or gift card requests, deepfake voice or video calls, and travel or personal device risks. |
| IT and system administrators | Separate admin accounts, phishing-resistant MFA, help desk identity checks before password or MFA resets, and how attackers target admin consoles. |
| Front counter, reception and customer service | Verifying callers before sharing or changing personal details, handling suspicious attachments from the public, and social engineering by phone. |
| HR and payroll | Payroll redirection scams, fake job applicant attachments, and protecting staff records. |
Running phishing simulations fairly
Simulated phishing emails can show whether training is working, but done badly they damage trust and make people less likely to report. Some simple rules:
- Tell staff the program exists before the first test, and explain the aim is learning, not catching people out.
- Measure reporting, not just clicking. A rising report rate and a faster time to report are better signs of a healthy culture than a falling click rate alone.
- Keep individual results private and never name people publicly. Follow up a click with short, immediate training rather than discipline.
- Avoid cruel lures, such as fake bonuses, pay rises or health scares, which upset staff and erode goodwill.
- Agree the scope in writing with management, and let your IT provider and email filtering know, so a test is not mistaken for a real attack.
Tools vary. In Microsoft 365, attack simulation training in Microsoft Defender requires Microsoft 365 E5 or Defender for Office 365 Plan 2 for each person tested, so it is not included in Business Premium on its own. Many small organisations use a separate low-cost awareness platform or run a few manual exercises instead. Check licensing before you plan around a tool; our Microsoft 365 licence review guide can help.
Free Australian resources to use
- The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) publishes plain-English guides for small business and individuals at cyber.gov.au, and runs ReportCyber for reporting incidents.
- Scamwatch, run by the National Anti-Scam Centre, lists current scams and lets you report them.
- Cyber Security Awareness Month each October is a useful anchor for a yearly refresher.
A 90-day plan for a small team
- Days 1–15: Choose a single way to report suspicious messages, write a one-page “what to do if” card, confirm the bank detail change procedure with finance, and tell staff the program is starting.
- Days 16–45: Run a 30 to 45 minute session for all staff on the core topics, with real examples relevant to your organisation, and short extra sessions for finance, managers and administrators.
- Days 46–75: Run a first gentle phishing simulation or tabletop exercise, share overall results with the team, and fix any process gaps it reveals, such as unclear reporting or a missing call-back step.
- Days 76–90: Add security awareness to onboarding (see our onboarding and offboarding checklist), record who completed training and when, and set a schedule of short refreshers and a yearly session.
Keep the records simple: a list of who attended which session, dates, and a summary of simulation results. That is usually the evidence insurers, auditors and buyers ask for, and it maps to the people side of frameworks such as the ACSC Essential Eight and the SA ISMF.
How EITSAA can help
If your team has never had practical security training, or it has become a once-a-year video nobody remembers, talk to us about a security awareness session or call 0402 401 584. We can run short, plain-English sessions built around your own systems, payment processes and the scams your staff actually see, add focused sessions for finance, managers and administrators, and help you set up reporting, a fair simulation approach and simple training records. Learn more about our training and team consultations and managed IT and cyber security services.