One Monday morning, Sophie B. catches a colleague with her mouse hovering a centimetre away from a link, in an email that mimics their bank to perfection. No harm done this time: a moment of doubt was enough to hold back the click. But Sophie, a partner at an accounting firm, realises two things at once. First, that no one on her team has ever been given clear guidance on what to look for. Second, that "training everyone in cybersecurity" has always felt like a luxury reserved for large firms — a budget she doesn't have.
Why security awareness training costs less than you think
The good news fits in a single sentence: most attacks that hit a small business don't target a technical flaw, they target a person in a hurry. Phishing — those fake messages that push you to click, pay or hand over a password — works because it imitates an ordinary request: an invoice, a parcel, an "urgent" note from management. No firewall replaces the second of attention that makes someone say, "this is odd, let me check."
That is exactly what makes awareness affordable. A firm like Sophie B.'s doesn't need an e-learning platform costing several thousand francs a year, nor an in-house IT specialist. What protects it is shared reflexes, kept alive over time. And a reflex is built with time and consistency, not with a line in the budget.
In a small organisation, this logic is reinforced by a detail that works against you: decision-making is fast and informal. When everyone knows each other and meets at the coffee machine, no one wants to question a request that seems to come from a familiar colleague or client. That trust, so valuable day to day, becomes a way in for anyone who can imitate it. A well-crafted fake email exploits precisely that closeness. The countermeasure costs nothing: make it normal to verify, even — especially — when the request appears to come from a familiar face.
There's a Swiss reason to get to it, too. The nFADP — the new Federal Act on Data Protection, in force since 2023 — expects a company holding sensitive data to take "appropriate" security measures. For a firm handling the accounts, payroll and tax data of dozens of clients, a team that can spot a trap is clearly one of those measures. The National Cyber Security Centre (NCSC), Switzerland's public reference, likewise puts staff awareness at the top of its recommendations for SMEs. None of this calls for a big cheque.
What to remember
Three ideas are enough to change the game in a small organisation.
First: security is above all a matter of repeated behaviour, not one more piece of software. The best antivirus in the world won't recover a payment made in good faith to a fake supplier. An employee with the reflex to check will.
Second: the limiting factor isn't money, it's consistency. A marathon half-day session, forgotten three weeks later, protects less than fifteen minutes every month. We retain what we revisit often, not what we sit through once.
Third: your best teaching material already lands in your inbox. The real suspicious messages you receive beat any textbook case. They talk about your clients, your tools, your daily routine — so they stick. A homegrown example, discussed on the spot, leaves a far more durable mark than a generic video shot in a setting that looks like nothing your team knows.
These three ideas share one thing: they shift the question. You stop asking "how much will it cost to train everyone" and start asking "how do we anchor three or four good reflexes without overloading already-full days." Put that way, the problem shrinks at once — and becomes entirely within reach of a firm of a few people.
Habits to put in place this week
None of these three habits requires a budget, a tool to buy or IT skills. They require a decision and a little consistency.
1. The fifteen-minute security slot, once a month
Set aside fifteen minutes at the end of a team meeting you already hold. One topic at a time, and concrete: fake invoices this month, passwords next month, "urgent" requests from the boss after that. No slideshow, no jargon: a real situation, what could have been missed, what we do next time. Consistency builds the habit; that's what protects, far more than one big annual session. Rotate who runs it: each person prepares their slot in turn, and security stops being "management's topic."
2. Learn from real emails, not textbook cases
When a suspicious message arrives — and it will — turn it into an example. A quick share in your internal chat: "Look at this one: sender address almost right, urgent tone, a link that doesn't go where it claims. Here's what should have alerted us." Within a few weeks, the team builds its own gallery of traps, drawn from its own mail. It's free, it's vivid, and it beats any generic course, because it looks exactly like what your people will see tomorrow.
3. Make doubt easy and blame-free
Security's worst enemy in a small team is the fear of looking naive. Someone who clicked, or who hesitates, must be able to say so straight away, without dreading how others will react. Appoint a go-to person — often management itself in an SME — and spread a simple rule: "When in doubt, ask, and asking is never a mistake." One minute of checking out loud saves hours of repair. It's the least technical measure on this list, and probably the most rewarding. The day someone spontaneously says, "I nearly got caught, watch out for this message," you'll know the culture has taken hold. That signal can't be bought; it's cultivated, fifteen minutes at a time.
So where do you really stand?
These three habits create momentum, and they're often enough to move a firm from "no one had really thought about it" to a team with the reflex to doubt. But they don't yet tell you where your organisation is solid and where it still rests on goodwill alone. Who checks what? What happens when the go-to person is away? Do newcomers get the basics on their first day? Those are the blind spots a self-assessment lays bare.
That's exactly what Cyber Passport offers. It certifies nothing and declares you "compliant" with nothing: it shows you, question after question, where you really stand on security awareness training as on everything else, and what deserves your attention first. Enough to turn three good reflexes into a genuine company habit — without blowing the budget. To go further and build a lasting programme, our "Security awareness programme" blueprint lays out the full plan, step by step.
