Free security awareness training for a small team
Free security awareness training exists for small teams, mostly from government agencies. The UK’s NCSC offers a 30-minute online module with no login. Canada’s Cyber Centre offers a free self-paced course that requires a business email address. Australia’s ASD offers a downloadable kit. In the US, we found no free federal course for staff, only guidance and awareness kits.
Free security awareness training for your team
Start with a short, free module everyone can finish in one sitting, then repeat a few minutes of practice every few months. That is the training part of team-wide account security, and the easiest place to begin is the NCSC’s Top Tips for Staff, which the NCSC offers free to any organization.
A team of five does not need a paid platform to cover what the official guides ask for. Here is what is free, as we checked it on November 10, 2026.
The free options, country by country
| Country | Training | Format | Sign-up |
|---|---|---|---|
| UK (open to all) | NCSC Top Tips for Staff | Online, under 30 minutes, four topics and a short quiz; also available as a SCORM package for your own learning platform | None |
| UK | NCSC Exercise in a Box | 20 exercises on 12 themes, from micro-exercises to tabletop sessions | Not checked |
| Australia | ASD educational pack for small businesses | Checklist, quiz, poster, and short guides to download and share | None |
| Canada | Cyber Centre course CYB116S, “Cyber Security for small and medium organizations” | Self-paced, 14 modules of 20 to 60 minutes, $0 | Account with a business email address |
| US | No free federal course for staff found | CISA’s awareness month toolkit, FTC and NIST guidance | — |
| Anywhere | Google’s Phishing Quiz (Jigsaw) | Online quiz on spotting phishing | None on the home page |
Two notes on this table. Canada’s course is open to organizations registered to do business in Canada, refuses personal addresses such as Gmail or Hotmail, and its learning platform was offline for maintenance when we checked. In Australia, the Cyber Wardens site, long the free course of reference for small businesses, no longer offers its courses as of November 2026.
What the training should cover
The official guides agree on the topics:
- Common threats: phishing, business email compromise, and ransomware (ASD, FTC).
- Passwords and MFA: why each account needs its own password, and how a second factor works (ASD, Cyber Centre).
- Malicious emails and links, and which software staff may install (Cyber Centre).
- Internal rules: how to report a suspicious message, and who approves a payment or a change of bank details (ASD).
- What to do in an emergency (ASD).
The NCSC’s module covers four of these in under 30 minutes: strong passwords, securing devices, defending against phishing, and reporting an incident.
How often
The FTC asks small businesses to train employees “on a regular schedule” and to track who took part. The ASD says training should be refreshed periodically. Neither sets a frequency. Our suggestion for a small team: the NCSC module on each person’s first week, a 30-minute refresher twice a year, and one tabletop exercise a year, which also covers the yearly incident plan drill CISA recommends.
A first 30-minute session
A plan you can run on a video call, with no budget:
- 10 minutes: everyone completes Top Tips for Staff, or the first part of it.
- 10 minutes: each person checks, screen shared, that MFA is on for their email and that their password manager works.
- 10 minutes: agree on two rules, written down afterwards: where to forward a suspicious message, and how to confirm any request to pay or to change bank details, by calling a number you already have.
Repeat step 3 whenever someone joins. It is the part attackers test most, and the one no generic course can write for you.
Where training fits
Training is step 13 of our 15-step team checklist, next to the settings that make mistakes less costly.
What the official guides expect
If you aim for a certification such as Cyber Essentials, or follow your country’s small business guide, our comparison of government guidance shows where training sits in each.