Almost every company that has survived a security incident already had a "cybersecurity training" in place. Usually once a year, an hour-long deck, someone clicked "next-next-next", passed the quiz, got the certificate. Three weeks later that same person clicked "invoice from the courier" and the restore-from-backup began. This isn't a personal-failure problem. It's a training-that-pretends-to-do-something problem.
People in small companies don't click on phishing because they're stupid. They click because they have 200 emails a day, deadlines from yesterday, and one email looks exactly like ten others they need to process. A PowerPoint deck won't change that. A program that looks different will.
Why "training once a year" is theatre
Human brains forget. Ebbinghaus's forgetting curve says that after 24 hours you remember less than half of a lecture. After a week — around a dozen percent. After a month — practically nothing. A one-hour phishing deck in January stands no chance of protecting you against a June attack, even if it was perfect.
Second problem — this kind of training teaches definitions, not reflexes. An employee knows that "phishing means impersonating a sender", but hasn't built the habit "I always check the sender's domain before opening a finance attachment". Definitions live in the head; decisions happen at the mouse. There's a gap between the two that a one-hour deck can't jump.
Third problem — no feedback loop. You passed the quiz, got the certificate, done. Nobody ever checks whether you can actually recognise phishing. The company gives itself a good-student gold star and calms down for another year. That works exactly until it doesn't.
What a real program looks like
A sensible training program for a 20–50 person company has three parts and none of them is "an hour of PowerPoint once a year".
Monthly micro-training. Fifteen minutes, one concrete topic. January — how to spot a fake courier email. February — how to check a link before clicking. March — why you never enter your email password into a form linked from that email. Short, concrete, one habit at a time. People actually retain this, because they don't have to swallow everything at once.
Phishing simulations every 4–6 weeks. Not a quiz — a real email, sent to an employee on a normal working day, with a realistic pretext. Whoever clicks lands on an educational page that explains exactly what they missed. Nobody gets named and shamed, nobody gets scolded. It's about learning, not the stocks.
A clear reporting channel. A "report suspicious email" button in Outlook (right in the interface) or a simple phishing@company.com address where someone can forward a suspect email in two clicks. Every report is analysed by a human and the reporter gets an answer within an hour. That's the other side of the same coin: you teach people to recognise, but you also give them a way to act on it when they do.
Without all three of these at the same time, the program doesn't work. Training without simulations is theory without practice. Simulations without training is an ambush. Everything together, but no reporting channel, means people notice things but don't know what to do with them.
Phishing simulations — how not to turn them into a circus
Simulations are the most sensitive part of the program. Done badly, they discourage the team, destroy trust, and instead of teaching they create a "us versus IT" war. Done well, they're the most effective tool you have.
A few rules worth respecting:
- Never publish the names of people who clicked. Aggregated departmental stats — sure. A ranking of shame — never.
- Never link clicking to bonus, appraisal or promotion. Clicking on a simulation isn't misconduct. It's a data point that shows where you need more training.
- The pretext should be realistic but not cruel. A fake email about someone being fired or a family illness — no. Fake invoice, fake postal service notification, fake "your password expires today" — yes.
- Difficulty grows over time. Early simulations should be catchable by anyone paying attention (typos, weird domains). After three months you move to more sophisticated ones — an email from "the CEO" asking for an urgent transfer, a "new invoice to approve" that looks like it came from your accounting system.
- Always land on an educational page. Whoever clicks doesn't get a blank blue screen but a short page: "this was a simulation, here's what should have alerted you, here are three things to watch next time". Sixty seconds, concrete.
The tooling exists. KnowBe4, Sophos Phish Threat, Microsoft Attack Simulator built into Defender for Office 365 — they all work. Cost per user per month is usually a few to a dozen złoty (or roughly 2–4 EUR), often bundled with the training platform.
A real example
At one of our clients — a 22-person accounting bureau in Warsaw, standard Microsoft 365, Comarch Optima ERP for invoicing, serving about 180 SME clients — we started with a baseline measurement. We sent a phishing simulation with no prior training, just to see where the company really stood.
The result: of 22 people, 9 clicked within 24 hours. Five of them went a step further and entered their Microsoft 365 credentials in the fake login form. If that had been a real attack, the attacker would have had access to five accountants' mailboxes and full correspondence with clients within a day. For an accounting bureau, that is effectively closure — breach of professional secrecy, mandatory data protection authority notification, panicked calls from clients.
We launched the program: 15 minutes of micro-training on the first Tuesday of every month, a simulation every 5 weeks, a "report phishing" button in Outlook. Six months later we repeated the measurement — same type of simulation, similar difficulty. Clicks: 2 out of 22 people. Credentials entered: 0. In the same month, one of the accountants reported a real Business Email Compromise — an email pretending to be from a software vendor with an "updated bank account number". The request was for a transfer of 47,000 PLN. She reported it 4 minutes after opening it. The transfer never went out.
Program cost: about 8 PLN per user per month for KnowBe4 with simulations and a micro-training library, plus two hours a month of our time to pick topics and analyse results. Roughly 4,800 PLN a year. One blocked BEC paid for the program ten times over.
What it really costs and who should run it
For a 30-person company, a realistic budget looks like this. Training-and-simulation platform: 8–15 PLN per user per month, or 3–6 thousand PLN a year. The person running the program: either an internal IT admin (2–4 hours a month) or an external partner (similar time, on a retainer). Occasional extras — one bigger yearly session, updating policies, refreshing house rules — a dozen or so hours across the year.
All in, a 30-person company lands at 8–12 thousand PLN a year for a program that actually changes something. For comparison: a single phishing incident that ends in account takeover or a BEC transfer typically costs somewhere between tens and hundreds of thousands of złoty, plus legal fees, notification obligations and reputation damage. The program pays for itself on the very first blocked incident.
Who should run it — ideally someone who isn't only from IT. IT will pick the platform, launch simulations, prepare reports. But the message to the team ("this isn't a hunt, this is joint training"), the monthly rhythm, the ability to publicly thank the person who reported a real attack — that's a job for someone who thinks in terms of organisational culture, not logs. In a small company this usually means the CEO or operations director, supported technically by IT (in-house or external).
Where to start in your company
Start with measurement — not with training. Send one phishing simulation with no warning, see where the company really stands. It stings, but without that number you have no baseline to prove the program ever does anything.
Pick one platform — don't compare five for three months. Microsoft Attack Simulator in Defender for Office 365 is already switched on in many licences you already have. That's a good place to start.
Plan a six-month calendar — six micro-training topics, six simulations, one joint session. Put it in the company calendar the way you'd put in board meetings. It's work, not a one-off event.
Measure again after six months. Compare to the baseline. Show the team the chart — not a ranking of shame, just the trend. People like seeing that they're improving together. That's the difference between training people endure and a program they engage with.
An hour-long deck once a year soothes management's conscience but doesn't protect the company. What protects it is rhythm: short training each month, a simulation every few weeks, a reporting channel one click away.