One Tuesday morning, Sophie B. opens an email from a "supplier" announcing a change of bank details, right before an invoice falls due. She pauses, mentions it to a colleague, and together they spot the small detail that doesn't add up. Six months earlier, that invoice would probably have gone out without a second glance. What changed at the firm isn't the software: it's the reflex — and that reflex is the first benefit of a security awareness training effort.
A security awareness program: why your SME is on the front line
Most attacks that hit an SME don't target a technical flaw: they target a person. A well-crafted email, a pressing phone call, an attachment framed as "urgent". This is what we call phishing — a message that impersonates a trusted contact to push you into clicking, paying or handing over a password. No antivirus blocks a human decision made in a hurry.
In an accountancy firm, this reality is even more concrete. Staff handle salaries, tax filings and bank statements every day — some of the most sensitive information there is, covered by professional secrecy. Decision-making runs short and informal: people know each other, trust each other, approve things quickly. That closeness, so valuable day to day, becomes the ideal playground for an attacker who knows how to mimic a tone and manufacture a sense of urgency.
A security awareness program is therefore not "one more IT training session". It's the missing layer between your tools and your people: learning to recognise a weak signal, knowing what to do with a doubt, and above all feeling allowed to slow down before clicking. People sometimes talk about a "human firewall" — the idea that a team's shared vigilance stops what technology lets through. It's the link that tools, on their own, will never cover: software filters messages, but it doesn't replace the common sense of the person holding the mouse.
In plain terms: the question isn't "are my staff careful?", but "have they been given the means to be careful?". Nobody is born knowing how to spot a fake invoice or a forged email from management. These are skills that are learned, recalled and refreshed — exactly like reviewing first-aid gestures. An employee who hesitates, asks a question or flags a strange message isn't wasting time: they are making the program work. That shift in mindset — from a mistake to punish towards a reflex to encourage — is what separates an SME that suffers from an SME that learns.
What to keep in mind
A program run seriously — not a poster forgotten near the coffee machine, but a regular touchpoint — produces three effects that genuinely matter for an SME.
It builds a culture, not a constraint. When security becomes a shared reflex rather than a list of bans, it stops being "IT's problem". Everyone understands why a payment check or a unique password protects them and their clients. You move from vague worry to simple habits that everyone owns — and often to better communication between people who used to pass the responsibility around. Security becomes something you can talk about without awkwardness, where a doubt raised out loud beats a mistake kept quiet.
It cuts the number of incidents at the source. The vast majority of incidents start with a human action — a click, a transfer, a password reused from one service to another. Trained staff spot the fake invoice, report the suspicious email instead of opening it, and ask the question that avoids the error. Every incident avoided means hours that don't go into cleanup, data that stays where it belongs, and nights that stay quiet. Awareness doesn't erase risk, but it removes a large part of it before it costs anything.
It strengthens your clients' trust. For an accountancy firm, trust isn't a nice extra: it's the business itself. A client who hands you their books wants to know their data is in careful hands. The nFADP (the revised Swiss Federal Act on Data Protection, in force since 2023) actually expects "appropriate" security measures from any organisation that processes personal data — and staff awareness is part of that. Being able to say "here, everyone is trained and knows how to react" becomes a genuine commercial argument, not a box ticked for reassurance.
Habits to put in place this week
You don't need a budget, software or an outside provider to start. Three habits are enough to turn good intentions into a lasting routine.
1. Block a short, recurring slot
Fifteen minutes, once a month, in the whole team's calendar. One topic at a time, told through a real and relatable case: a fake invoice, a password shared on a sticky note, a call "from the boss" that feels a little too urgent. Format matters more than length: short, concrete, regular. Awareness that lives all year round leaves a far deeper mark than a big annual session quickly forgotten. And it doesn't have to be the manager running it all: rotating who leads the session is already a way to share ownership.
2. Write down your payment verification rule
Invoice fraud thrives on vagueness. Put a simple rule in writing, known to everyone: any change of bank details, like any unusual transfer request, is checked by a second pair of eyes and by a callback to a number you already know — never the one given in the message. A single sentence, displayed and repeated, protects better than a long protocol no one reads. The goal isn't to add friction, but to make the reflex automatic: when in doubt, slow down and verify, without being afraid of "bothering" anyone.
3. Make a new hire's arrival a security moment
On day one, we show the coffee machine and the printer; we often forget the essentials. Use onboarding — the set of steps that welcome a new arrival — to say, simply: here is the sensitive data we handle, here is who to ask in case of doubt, here are the two or three house reflexes. Security is far easier to learn from the start than to correct months later once habits have settled. The same principle applies when someone leaves: remembering to cut off access is part of the same culture.
Where do you really stand?
These habits get the momentum going, but they also raise an honest question: beyond good intentions, where does your organisation actually stand? A security awareness program isn't measured by the poster on the kitchen wall, but by what an employee does, alone, on a Tuesday morning, faced with a suspicious email.
That is exactly what the Cyber Passport self-assessment helps you map. It certifies nothing and doesn't declare you "compliant": it shows you, question by question, where your security culture stands firm and where it still rests on luck or on a single person. Enough to turn goodwill into a program, and a program into concrete evidence you can show your clients.
