In this guide · 8 sections
Short answer
A small business can start for free with CSA's employee toolkit and ScamShield material. Phishing simulations in Microsoft 365 need Defender for Office 365 Plan 2 at US$5 per user a month (or E5). Most SMEs need a tailored live session once or twice a year plus monthly reminders.
Why staff training matters for a small business
Technical controls stop a lot, but scams aimed at people get through them. A convincing phone call from someone posing as a government officer, a supplier email with new bank details or a fake Microsoft login page all rely on a person acting. CSA's Cyber Essentials mark includes people in its Assets area: staff should know how to spot phishing and scams, and who to tell when something looks wrong.
The aim of training is not to make staff security experts. It is to make three habits automatic: pause before acting on urgency, verify through a known channel, and report quickly without fear.
Training formats compared
There are three main formats. Most small businesses use a mix of the first two, and add simulations once the basics are in place.
| Format | What it is | Strengths | Weaknesses |
|---|---|---|---|
| Live session | 30 to 60 minutes, in person or video, run for your team | Tailored to your systems and real scams; staff can ask questions | Needs scheduling; content ages without refreshers |
| E-learning modules | Short videos and quizzes staff complete online | Consistent, trackable, easy for new joiners | Generic content; easy to click through without attention |
| Phishing simulations | Fake phishing emails sent to staff, with instant training for those who click | Tests real behaviour; shows progress over time | Can feel like a trap if handled badly; needs licences or a tool |
| Monthly reminders | One short example scam or tip a month | Keeps it fresh at almost no cost | Not enough on its own |
What security awareness training costs (October 2026)
Prices vary widely because many training platforms only quote on request. These are reference points from published sources:
- CSA toolkit for employeesGuides and material for small organisations, from CSA's SG Cyber Safe ProgrammeFree
- ScamShield and SPF scam advisoriesCurrent Singapore scam examples to use in briefingsFree
- Microsoft Defender for Office 365 Plan 2Includes attack simulation training; also in Microsoft 365 E5US$5/user/mo, paid yearly
- Commercial training platformsAsk for the price at your headcount and a sample moduleUsually quoted per user per year
- Tailored live session for your teamOur package is S$390, including a written payment verification procedureOne-off fee
Typical 10-person SME, first yearFrom S$0 (DIY) to a few hundred dollars plus staff time
Microsoft price from its Defender for Office 365 page, approximate as of October 2026, before GST.
Microsoft's price is from its Defender for Office 365 page; Microsoft's attack simulation training guide confirms the Plan 2 requirement. Staff time is the real cost: an hour a year per person for a session, plus a few minutes a month for reminders. That is small next to the cost of a single paid fake invoice.
Free material you can use today
Singapore agencies publish practical, local material that suits a team briefing:
- CSA's toolkit for employees, written for staff in small organisations starting their cybersecurity journey.
- CSA's SG Cyber Safe Programme pages, which also have toolkits for owners and IT staff.
- ScamShield for current scam types and the 24/7 helpline at 1799, which staff can call when unsure.
- Our own guides on how to spot a phishing email and government official impersonation scams, which you can share with staff.
What works, and what to avoid
Training that frightens or shames staff tends to backfire: people stop reporting mistakes because they fear the consequences, and you find out about the incident days later. Aim for training that is short, specific and supportive.
Works
- Short sessions tied to each role: finance on invoice fraud, front desk on phone scams
- Showing exactly how to report, with one button or one contact
- Thanking people who report, including those who clicked first
- Refreshing every few months with new local scam examples
Avoid
- One long annual video everyone skips through
- Naming or punishing people who clicked a simulation
- Simulations that imitate personal matters such as bonuses or medical results
- Generic overseas content that ignores Singapore scams
How often to train and how to measure it
A workable rhythm for a 5 to 50-person business:
Onboarding: within the first week
Every new joiner gets a 20-minute briefing on passwords, MFA, phishing, payments and how to report.
Twice a year: a live session
Cover recent scams seen in Singapore and in your own inbox, plus any new systems.
Monthly: one short reminder
One real example and one habit, sent by email or chat.
Quarterly, if licensed: a phishing simulation
Vary the theme and difficulty, and give immediate, friendly feedback to anyone who clicks.
Track a few numbers
Simulation click rate, report rate, and time from a real phishing email arriving to the first report.
The report rate matters more than the click rate. A team where most people report suspicious emails within minutes catches attacks that a few people fall for.
Do it yourself or get help?
An owner or office manager can run a useful briefing with CSA's toolkit and a few real examples, then send monthly reminders. Get help if you want the session tailored to how your business pays suppliers and handles customer data, or if no one internally has time to keep it going.
Our Security Awareness Training (S$390) is a live session for your team built around your own systems and recent Singapore scams, with a written payment verification procedure and reminder material for the following months.
Frequently asked questions
It ranges from free to a few hundred dollars a year for a small team. CSA's employee toolkit and ScamShield material are free. Microsoft's phishing simulation tool needs Defender for Office 365 Plan 2, listed at US$5 per user per month on yearly billing as of October 2026. Commercial platforms are usually quoted per user per year.
CSA's Cyber Essentials mark includes people in its Assets area: staff should be able to recognise phishing and scams and know who to report suspicious activity to. Regular, documented training is the practical way to show this during certification.
Yes, with Attack simulation training in the Microsoft Defender portal. Microsoft says it is available to organisations with Defender for Office 365 Plan 2, either as an add-on or included in plans such as Microsoft 365 E5. Microsoft 365 Business Premium alone does not include it.
A practical rhythm for a small business is a briefing for every new joiner, a live session twice a year, a short reminder each month and, if you have the tools, a phishing simulation each quarter. Short and frequent works better than one long annual session.
Generally no. Punishing people for clicking discourages them from reporting real mistakes quickly, which is what limits damage. Give immediate, friendly feedback, thank people who report, and handle repeated issues privately with extra coaching.