Staff and phishing: the free NCSC training and a simple plan for small teams

Most small business owners know phishing is a risk. Far fewer have ever sat their team down for ten minutes to talk about it. The government's latest survey suggests that gap is wide, and the National Cyber Security Centre (NCSC) offers a free way to close it. This post explains what is on offer, what the evidence says about training, and a simple plan you can run this week.

What the 2025/2026 survey found

The Cyber Security Breaches Survey 2025/2026, published by the government on 30 April 2026, found that 43% of UK businesses experienced a breach or attack in the last 12 months. Phishing was widespread: 38% of businesses reported phishing attacks. Among businesses that had experienced any breach or attack, 51% had experienced phishing only, with no other type.

It also matters how much damage it does. Of the businesses that identified a breach or attack, 69% said phishing was the most disruptive type, rising to 70% among micro businesses.

Now the uncomfortable part. Only 19% of businesses overall ran any staff training or awareness raising in the last 12 months. For micro businesses the figure was 14%, and for small businesses 33%. If you have not trained your team, you are in the large majority, but the same people are being targeted every day.

The free NCSC course

The NCSC publishes a package called Top Tips for Staff. Here is what its own pages say about it:

• It is completely free and takes less than 30 minutes.
• No login is needed. You send staff a link and they can start learning.
• It was designed for a non-technical audience, mainly small and medium-sized businesses, charities and the voluntary sector.
• It explains why cyber security matters and how attacks happen, then covers defending against phishing, using strong passwords, securing devices and reporting incidents.
• It ends with a short quiz and links to further reading.
• The English version meets Web Content Accessibility Guidelines 2.1 Level AA, and a Welsh version is available.

If you already use a training or learning platform, you can download the course as a SCORM package (SCORM 2004 or SCORM 1.2 for English) and load it there. It is licensed under the Open Government Licence, so you can adapt it, for example by setting a pass mark for the quiz. The NCSC also provides a printable infographic of the core messages, which suits a staff room wall or a shared drive.

Training alone is not enough

It is worth being honest about what training can do. The NCSC's own phishing guidance says: "No training package, including phishing simulations, can teach users to spot every phishing attempt." Its answer is a layered approach rather than relying on staff to be perfect:

• Make it hard for attackers to reach your people. Use email filtering and anti-spoofing controls such as SPF, DKIM and DMARC.
• Help people spot and report suspect messages. Training, plus a reporting route that is clear, simple and quick to use.
• Limit the damage from a click. Keep devices updated, limit administrator accounts and use multi-factor authentication.
• Respond quickly. Have a plan for what happens when something goes wrong, and practise it.

Training is the second layer, not the whole defence. If you want help with the technical layers, such as email authentication, backups and account security, our cloud and security team can look at it with you.

Do not blame the person who clicked

One of the most useful points in the NCSC guidance is about culture. Staff who fear punishment will not report a mistake, and a quiet mistake is the one that grows. The NCSC advises against reprimanding people who struggle to spot phishing and against a punishment or blame-oriented culture. It also suggests measuring how many people report suspicious emails, not just how many click, because that rewards openness. And it says staff should feel safe reporting even after they have clicked a link.

The guidance adds a caution about phishing simulations (fake phishing emails sent to your own team): they can create legal risk, so check with HR or your advisers first. For a small team, the free course plus a good reporting habit is a sensible starting point.

Where to report suspicious emails

The NCSC asks you to forward suspicious emails to report@phishing.gov.uk, without clicking any links first. You can forward as many as you like, including ones you are not sure about. Emails already in your spam folder do not need forwarding. The NCSC says it cannot share the outcome of its review of each one, but it acts on every message it receives.

If someone has responded to a scam and money was lost or an account was hacked, that is a crime to report separately. In England, Wales or Northern Ireland, use Report Fraud (reportfraud.police.uk) or call 0300 123 2040. In Scotland, call Police Scotland on 101. The NCSC email address is not a crime-reporting channel.

A plan for this week

• Monday: Do the 30 minute course yourself, so you know what your team will see.
• Tuesday: Send the link to everyone, including part-timers, freelancers and anyone with a company email address. Ask for it to be done by Friday.
• Wednesday: Decide who staff tell when something looks wrong, and write the name or channel down. Make it quick and easy, and make it clear nobody will be in trouble for asking.
• Thursday: Print the NCSC infographic and put it somewhere visible.
• Friday: Check that multi-factor authentication is switched on for email and your accounting software, since those are what attackers want most.
• Next quarter: Put a repeat date in the diary and give new starters the course in their first week.

The bottom line

Phishing hit 38% of businesses, was named the most disruptive attack by 69% of those breached, and fewer than one in five businesses train their staff. A free 30 minute course will not stop every attack, as the NCSC itself says, but combined with a simple reporting habit and a few technical safeguards it puts you ahead of most of your peers. It costs an afternoon and nothing else.