Staff cyber awareness training kit
4 min readReviewed October 2026 · Internet Safety Australia Editorial Team
In short
- 15 minutes a quarter beats an annual day-long course nobody remembers.
- Three messages: verify payment changes by phone, don’t trust unexpected attachments, report fast without blame.
- A “no blame for reporting” culture is your cheapest security control.
The quarterly 15-minute session
Message 1: Verify money moves (3 min)
Any bank-detail change, new payee or urgent payment gets verified by phone on a known number. No exceptions, including requests from the boss — especially requests from the boss.
Message 2: Unexpected = untrusted (5 min)
Walk through two real phishing emails (find current examples via Scamwatch alerts). Point out the hook, the pressure and the trap. Rule: unexpected attachments and links get checked before opening, every time.
Message 3: Report fast, no blame (3 min)
The worst outcome isn’t clicking — it’s clicking and hiding it for three days. Say explicitly: report immediately, no blame, ever. Speed is what saves the business.
Quiz (4 min)
Show three screenshots — two phishing, one genuine — and have the team vote. Wrong answers are the teaching moment.
Make it stick
Print our small business cyber hygiene checklist (Resources → Downloads) for every desk, and run the ACSC’s free Cyber Health Check annually as a team exercise.
Common questions
Where to report this
Report to ReportCyber
Cybercrime: identity theft, online fraud, hacked accounts or devices, ransomware and online threats.
Go to ReportCyber (leaves our site — official service)Official sources for this guide
Reviewed October 2026 by Internet Safety Australia Editorial Team. Internet Safety Australia is independent and not a government website.