Cybersecurity · Training
How to set up awareness training and phishing simulations for a small team, how often to run them and how to measure whether they work.
Monthly, short and specific
Measure reports, not only clicks
No blame, fast feedback
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Effective phishing training for employees combines short, regular lessons with monthly phishing simulations that give instant feedback to anyone who clicks, and it rewards people for reporting suspicious messages. Annual hour-long videos do little on their own. Plan on a baseline test, a short session for everyone, then a simulation and a few minutes of training every month.
It works when done consistently. KnowBe4’s 2026 Phishing by Industry Benchmarking Report, based on 42 million simulations, found an average of 33.2 percent of untrained employees clicked or otherwise fell for a test, falling to 20.1 percent after 90 days of training and 4.2 percent after 12 months. KnowBe4 sells training, so treat its numbers as a vendor benchmark, but the pattern matches what we see in practice.
Before any training, send one realistic simulated phishing email to everyone. Do not announce it. Record three numbers:
KnowBe4’s report puts the baseline for small organizations at 24.7 percent. Whatever your number is, it becomes the line you improve from.
Skip long lectures about hackers. A first session of 20 to 30 minutes should cover:
Want to know how your people and systems would hold up? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, IT operations and business continuity, with the next steps in order. It is yours to keep, with no obligation. Book your assessment.
The share of people who typed a password into a fake page. Drive this toward zero.
The share who reported the test. A rising report rate means people are spotting threats and telling you, which also catches real attacks early.
How quickly the first person reports a test. In a real attack, that report is your early warning.
Click rate is useful but can mislead, because harder tests raise it. Look at trends over six to twelve months, and by department, rather than a single campaign.
New hires should get the kickoff session in their first week and join the monthly cycle right away. Their first weeks are when they are least likely to know what normal requests look like, which makes them attractive targets.
NIST’s guidance on building a cybersecurity learning program, SP 800-50 Rev. 1, recommends treating training as an ongoing program with goals and measurement, not a one-time event.
Even well-trained teams click sometimes. Pair training with multi-factor authentication, email filtering and endpoint protection, so one mistake does not become an incident. Our Microsoft 365 security settings guide covers the technical side. JLB USA’s cybersecurity services combine those controls with practical support for businesses with about 25 to 100 employees.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
A short session at hiring and once a year, plus a phishing simulation and a few minutes of training every month, is a good default for small businesses.
Consistent programs reduce risky behavior. KnowBe4’s 2026 benchmark found average susceptibility fell from 33.2 percent before training to 4.2 percent after 12 months.
CISA and NIST publish free awareness material suitable for a first session. Running ongoing simulations usually needs a paid tool or a Microsoft Defender for Office 365 Plan 2 license.
No. Shaming discourages reporting. Use private coaching for repeat clickers and reward people who report suspicious messages.
