How to Build a $0 Security Awareness Program for SMBs

The Problem: Training Is Skipped, Not Because It’s Unimportant

Most small businesses know they should train staff on cybersecurity. They also know that a single employee clicking the wrong link can result in ransomware, data breaches, or business email compromise.

Yet security awareness training is routinely postponed or skipped entirely. The reason is simple: cost.

Commercial security awareness platforms charge hundreds to thousands of dollars per year per employee. For a 15-person business, that can mean $5,000–$15,000 annually—a budget line most SMBs cannot justify.

The good news: you do not need a commercial platform to build effective security awareness. With deliberate effort and free resources, you can create a functional training program at zero cost.

Why Free Does Not Mean Ineffective

Security awareness training has one job: change behaviour. It needs to ensure your staff:

• Recognise phishing emails and suspicious links
• Use strong, unique passwords with a password manager
• Enable multi-factor authentication on all accounts
• Report security incidents immediately
• Follow your organisation’s acceptable use policies

None of these outcomes require expensive software. They require:

1. Clear, repeatable content delivered regularly
2. Practical examples relevant to your business
3. A culture where security is everyone’s responsibility
4. Accountability through simple tracking

You can achieve all of this without spending money.

The Three Pillars of a $0 Security Awareness Program

Pillar 1: Content (What You Teach)

Use free, high-quality educational resources from trusted organisations:

Australian Cyber Security Centre (ACSC)

The ACSC publishes free, SMB-focused security guidance:

• Publications: Downloadable guides on phishing, ransomware, internet safety
• Small Business Cyber Security Guide: Step-by-step advice tailored to Australian SMBs
• Alerts and advisories: Current threat intelligence

These are authoritative, localised, and updated regularly.

Industry Associations

Many industry bodies provide free cybersecurity training tailored to their sectors:

• Australian Banking Association: Scam and fraud awareness
• OAIC: Privacy and data handling training modules

Open-Source Training Platforms

Several organisations offer free security awareness content:

• SANS Security Awareness: Free posters, newsletters, and tip sheets
• National Cyber Security Centre (UK): Free training modules and guidance
• CISA (USA): Free resources and toolkits

While not all are Australia-specific, the principles are universally applicable.

Pillar 2: Delivery (How You Teach)

You do not need a learning management system (LMS) to deliver training. Use tools you already have:

Email-Based Micro-Learning

Send a short, focused security tip every week or fortnight via email.

Format:

• Subject: “Security Tip: [Topic]”
• 2–3 sentences explaining the risk
• 1–2 sentences explaining what to do
• Optional: link to a relevant ACSC resource

Example:

Subject: Security Tip: Recognising Phishing Emails

Phishing emails often create urgency (“Your account will be suspended!”) to bypass your judgment. Before clicking any link, hover over it to see the real URL—if it doesn’t match the claimed sender, it’s likely phishing.

If unsure, contact the sender via a known phone number, not by replying to the email.

More: ACSC Phishing Guidance

This approach requires no software beyond your existing email system.

Lunch-and-Learn Sessions

Host a 15–30 minute session once per quarter during lunch (or another convenient time). Use free video conferencing tools if your team is remote.

Topics:

• Phishing identification workshop (show real examples)
• Password manager setup demonstration
• Multi-factor authentication walkthrough
• Privacy Act obligations and data handling

Delivery:

• Create a simple slide deck using Google Slides or PowerPoint
• Use real-world examples from recent news or industry breaches
• Make it interactive—ask staff to identify phishing red flags

Record these sessions so new employees can watch them during onboarding.

Posters and Visual Reminders

Print simple, visual reminders and place them in common areas:

• “Hover before you click”
• “Use MFA everywhere”
• “When in doubt, ask IT”

SANS Security Awareness offers free downloadable posters designed for this purpose.

Pillar 3: Measurement (How You Track)

You need evidence that training is happening and that staff understand it.

Attendance Tracking

Maintain a simple spreadsheet:

This provides audit evidence that training occurred.

Knowledge Checks

After training sessions, ask simple questions to confirm understanding. Use Google Forms (free) to deliver a 3–5 question quiz.

Example Questions:

1. What is the first thing you should do if you receive a suspicious email? (Report it to IT; Delete it and report; Ignore it)
2. True or False: It is safe to use the same password across multiple work accounts if it is very strong.
3. Which of these is a phishing red flag? (Urgent language; Unexpected attachment; Generic greeting; All of the above)

Track completion. If someone scores poorly, follow up individually.

Simulated Phishing Tests

You can run phishing simulations for free using basic techniques:

1. Send a test email from a safe address that mimics a phishing attempt (e.g., fake “urgent action required” from a made-up sender)
2. Include a unique link that logs who clicked it (use a URL shortener with analytics, or a simple Google Form)
3. Anyone who clicks receives immediate, non-punitive feedback (“This was a test. Here’s what to look for next time.”)

This is not as sophisticated as commercial phishing platforms, but it serves the same purpose: identifying who needs additional training.

Important: Do not punish people who fail phishing tests. The goal is education, not humiliation.

How to Build Your Program: A 90-Day Plan

Month 1: Foundation

Week 1: Define your training topics

Based on your organisation’s greatest risks, identify 4–6 core training topics:

• Phishing and email security
• Password hygiene and password managers
• Multi-factor authentication
• Physical security (e.g., locking workstations, visitor access)
• Data handling and privacy obligations
• Reporting security incidents

Week 2: Source content

Find relevant free resources for each topic from ACSC, SANS, OAIC, or your industry association. Bookmark or save these resources.

Week 3: Schedule training

Decide on a delivery cadence:

• Quarterly lunch-and-learns
• Fortnightly email tips
• Annual onboarding training for new hires

Add these to the company calendar.

Week 4: Create tracking tools

Build a simple attendance spreadsheet and a Google Forms quiz template.

Month 2: Launch

Week 1: Deliver your first training session

Host your first lunch-and-learn on phishing. Use real examples from recent breaches. Show staff how to identify suspicious emails.

Week 2: Start email micro-learning

Send your first “Security Tip” email. Keep it short and actionable.

Week 3: Deploy visual reminders

Print and display posters in common areas. Place stickers on monitors reminding staff to lock their screens.

Week 4: Run your first knowledge check

Send a 3-question quiz via Google Forms. Track who completes it and scores.

Month 3: Reinforce and Iterate

Week 1: Follow up on quiz results

Reach out individually to anyone who scored poorly or did not complete the quiz. Offer additional support.

Week 2: Continue email tips

Send your second fortnightly security tip.

Week 3: Conduct a phishing simulation

Send a test phishing email. Track who clicks. Provide immediate, educational feedback.

Week 4: Review and improve

Review attendance, quiz results, and phishing click rates. Identify topics that need more emphasis. Adjust content or delivery as needed.

Free Tools You Can Use

Content Creation

• Google Slides / PowerPoint: Create training presentations
• Canva Free: Design posters and visual reminders
• ACSC Publications: Download authoritative Australian cybersecurity resources

Delivery

• Email: Send micro-learning tips
• Google Meet / Zoom (Free): Host virtual lunch-and-learns
• Slack / Microsoft Teams: Post security tips in a dedicated channel

Measurement

• Google Forms: Build quizzes and track responses
• Google Sheets / Excel: Track attendance and completion
• Bitly: Track phishing simulation link clicks (free tier)

Additional Free Resources

• SANS Security Awareness Posters: Ready-to-print visual materials
• OAIC Resources: Privacy and data handling guidance
• CISA Cybersecurity Awareness Program: Toolkits and tip sheets

What to Cover in Each Training Topic

Topic 1: Phishing and Email Security

Key Messages:

• Phishing is the #1 entry point for attacks
• Red flags: Urgency, generic greetings, unexpected attachments, suspicious links
• Always verify sender identity before clicking or downloading

Activities:

• Show real phishing examples
• Demonstrate how to hover over links
• Practice reporting suspicious emails

Topic 2: Password Hygiene and Password Managers

Key Messages:

• Weak, reused passwords are easily compromised
• Password managers generate and store strong, unique passwords
• Free password managers exist (Bitwarden, browser built-ins)

Activities:

• Demonstrate how to install and use a password manager
• Show staff how to generate strong passwords
• Explain why password reuse is dangerous

Topic 3: Multi-Factor Authentication (MFA)

Key Messages:

• MFA prevents account takeovers even if passwords are stolen
• Enable MFA on email, cloud platforms, and banking
• Use authenticator apps, not SMS when possible

Activities:

• Walk through enabling MFA on Microsoft 365 or Google Workspace
• Show how to set up an authenticator app
• Address common objections (“It’s too inconvenient”)

Topic 4: Physical Security

Key Messages:

• Lock your screen when leaving your desk (Windows: Win+L, Mac: Cmd+Ctrl+Q)
• Do not leave sensitive documents visible
• Challenge unfamiliar people in your workspace

Activities:

• Demonstrate screen lock shortcuts
• Discuss visitor management policies
• Review clean desk policies

Topic 5: Data Handling and Privacy

Key Messages:

• Personal information must be protected under the Privacy Act
• Only collect, store, and share data you need
• Encrypt sensitive files and emails

Activities:

• Review what counts as personal information
• Explain your organisation’s data retention policies
• Show how to encrypt files or use secure file sharing

Topic 6: Reporting Security Incidents

Key Messages:

• Fast reporting limits damage
• No one will be punished for reporting a mistake
• Know who to contact (IT manager, security lead)

Activities:

• Share the reporting process (email address, phone number, ticketing system)
• Walk through examples of what should be reported (suspicious email, lost device, unexpected account activity)
• Emphasise that reporting is encouraged, not punished

How to Maintain Your Program Over Time

Quarterly Refresh

Every three months:

• Review training attendance and quiz scores
• Update content based on recent threats or organisational changes
• Conduct a new lunch-and-learn on a rotating topic
• Run a phishing simulation

Annual Review

Once per year:

• Assess program effectiveness (Are click rates on phishing simulations improving? Are incidents being reported promptly?)
• Update your training materials to reflect new threats or regulatory changes
• Survey staff for feedback (“What topics do you want to learn more about?”)
• Report metrics to leadership (training completion rates, phishing test results)

When to Expand

If your organisation grows, or if you secure budget, consider upgrading to a commercial platform. But until then, this free program provides foundational security awareness that most SMBs lack entirely.

Common Objections and How to Address Them

”We don’t have time for training”

Response: Each session is 15–30 minutes per quarter. Email tips take 2 minutes to read. The time cost of a successful phishing attack is far greater.

”Staff will ignore it”

Response: Make it engaging. Use real examples. Tie it to their role (e.g., finance staff see stories about invoice fraud; HR sees credential theft examples). Track completion and follow up with non-participants.

”Free resources won’t be taken seriously”

Response: ACSC, SANS, and OAIC are authoritative sources. Frame training as compliance and risk management, not optional education.

”What if someone makes a mistake?”

Response: Mistakes are learning opportunities. Emphasise that reporting mistakes early prevents bigger problems. Never punish honest errors.

Measuring Success

Your program is working if:

• Phishing click rates decrease over time (e.g., from 30% to 10% over six months)
• Incident reporting increases (staff are more aware and willing to report)
• Training completion is high (>90% of staff complete quarterly training)
• Knowledge check scores improve (staff retain key concepts)
• Cyber insurance renewals are easier (many insurers now require evidence of security awareness training)

Track these metrics and report them to leadership quarterly.

Quick Start Checklist

Use this checklist to launch your $0 security awareness program:

• Identify 4–6 core training topics relevant to your business
• Bookmark free resources (ACSC, SANS, OAIC)
• Schedule quarterly lunch-and-learn sessions
• Create a simple attendance tracking spreadsheet
• Build a Google Forms quiz template
• Send your first security tip email
• Print and display security awareness posters
• Conduct your first training session
• Run a phishing simulation within 90 days
• Review results and iterate

Action Item: Schedule your first security awareness lunch-and-learn within the next 30 days. Choose phishing recognition as your topic, source examples from recent ACSC alerts, and invite all staff. Track attendance and follow up with a simple quiz to measure understanding.