The Essential Eight is the Australian Signals Directorate's framework of eight mitigation strategies that work together to harden an organisation against common attacks. Awareness training is not one of the eight — but every strategy that touches users assumes the human layer holds, and several, most notably multi-factor authentication, only work as designed when staff have been trained. This guide explains what the Essential Eight actually requires, where awareness training fits, and how to build evidence an auditor will accept.
TL;DR
- The Essential Eight is ASD's set of eight mitigation strategies across three maturity levels (ASD Essential Eight).
- Awareness training is not one of the eight — but the framework assumes users will not be the weak link, and a human element sits behind roughly 60% of breaches (Verizon 2025 DBIR).
- MFA, one of the eight, cuts account-compromise risk by 99.22% (Microsoft research) — yet relay kits and push-bombing still reach staff, which is where training earns its keep.
- Australian SMBs self-report an average incident cost of $56,600 (ASD Annual Cyber Threat Report 2024-25).
- Awareness platforms run $10-$72 per employee per year; a 50-person team commonly lands $900-$1,800 annually.
What the Essential Eight is
The Essential Eight is ASD's baseline mitigation framework, developed from what actually stops the threats Australian organisations face. It consists of eight strategies designed to work together — ASD's Essential Eight page links the full strategy detail, the maturity model and the assessment guidance. The eight are:
- Application control
- Patch applications
- Patch operating systems
- Restrict Microsoft Office macros
- User application hardening
- Restrict administrative privileges
- Multi-factor authentication
- Regular backups
Implementation is graded on a maturity model from Level 1 to Level 3, with each strategy's requirements stepping up at each level. Organisations working toward certification or tender compliance are assessed against those maturity levels, and the evidence — configurations, logs, records — is what the assessment checks.
Why awareness training is not one of the eight — and why it still matters
The framework is deliberately technical. It protects systems, not behaviour: patch what is vulnerable, block what is dangerous, restrict who can do damage, back up what matters. That is a legitimate design choice — but it leaves a gap the framework itself cannot close.
Staff sit inside several of the eight whether the framework says so or not:
- MFA depends on user decisions. Staff approve prompts, and push-bombing works precisely because a fatigued employee approves the third prompt at 11pm. Microsoft's research measured a 99.22% reduction in account-compromise risk from MFA across its commercial population — meaning the residual risk is concentrated in the person deciding whether to approve (Microsoft research).
- Administrative privileges are used by people. Restricting admin rights only works if staff with elevated access follow the rules and report attempts to have them lifted.
- The attacks that reach the human layer are not all technical. Invoice fraud and payment redirection carry no malware and trip no filter — they are decided entirely by a staff member's verification habit.
The breach data quantifies the gap. Verizon's 2025 Data Breach Investigations Report analysed 22,052 incidents and 12,195 confirmed breaches and again found a human element in roughly 60% of them — the share that no patch, macro block or backup closes on its own. And locally, ASD's Annual Cyber Threat Report 2024-25 puts the average self-reported cost of a cybercrime incident at $56,600 for an Australian small business.
The practical reading: the Essential Eight is the technical floor, and awareness training is the complementary human-layer control that keeps the technical controls from being bypassed through people. Businesses working toward SMB1001 certification will also find staff awareness work assumed at the entry tier — training is the evidence line that satisfies it.
What Essential Eight-aligned awareness training looks like
An awareness programme aligned to the framework does three things the annual video does not:
- Trains the behaviours the eight depend on. MFA approvals that deserve scrutiny, admin-access requests that get reported, payment changes that get verified by phone on a known number. The curriculum should map to the strategies your maturity target touches.
- Runs monthly, not annually. The benchmark data is clear about cadence: KnowBe4's 2026 report, built on 67.7 million simulated phishing tests across 14.5 million users, puts baseline phishing susceptibility at 33.2% — one in three staff clicks a malicious email untrained — and shows the reduction to 4.2% lands across twelve months of sustained training (KnowBe4 2026 benchmark). The gains accrue between month three and month twelve, which is exactly where a hand-run programme lapses — so the cadence should be automated end to end (automated awareness platforms).
- Produces evidence an assessment accepts. Per-learner completion records with dates, click and report trends, and exportable reports — the artefacts an auditor or insurer asks to see. Human risk reporting is the pattern: click rate, report rate and completion rolled into a monthly trend per person.
A working programme pairs monthly micro-lessons with phishing simulations and same-day coaching for anyone who clicks — the click is the teachable moment, not a disciplinary event.
What it costs
Awareness platforms price at $10-$72 per employee per year depending on tier; a 50-person business typically lands $900-$1,800 annually at a mainstream tier. Set against the alternatives, the line is small: IBM's 2026 Cost of a Data Breach Report puts the global average breach at USD 4.99 million, up 12% and a record high, while the local ASD figure for small business sits at $56,600 per reported incident. A year of training for the whole team costs a fraction of one near-miss.
If you are unsure whether the human layer is even your biggest exposure before spending, a security gap assessment scores your controls against the Essential Eight (and SMB1001) and tells you which control deserves the next dollar. The vendor-by-vendor side-by-side on the comparison page shows which awareness platforms produce assessment-ready evidence.
How to align your programme with an E8 target
- Pick your maturity target. ML1 is the baseline most small and mid-sized organisations work toward; your target decides which strategies get evidence attention.
- Map training to the strategies. Build the curriculum around MFA behaviour, privilege discipline and payment verification — the three places staff decisions touch the framework.
- Run a baseline simulation. The honest click rate is the number every later improvement is measured against — and it is the evidence line an assessor cares about.
- Automate the cadence. Directory-sync enrolment, a self-scheduling campaign calendar and auto-remediation keep the programme running without an owner chasing it.
- Export the evidence monthly. Per-learner completion with dates, click trends and report rates, filed where your E8 evidence lives — alongside patching records and backup logs.
- Re-assess against the target. Repeat the cycle; the trend line, not a completion certificate, is what proves the control works.
Common mistakes
- Treating the eight as the whole programme. They protect systems; they do not change what a staff member does with a payment-change email. Pair them.
- Assuming MFA closes phishing. It closes most account compromise; it does not stop the phishing message itself, and relay kits are built to defeat it. Training covers what lands in the inbox.
- No baseline. Without the first simulation's number, nobody can prove the programme moved anything at assessment time.
- Evidence after the fact. Auditors ask for dated per-learner records. Retro-fitting them after the assessment request is the mistake that turns a passing review into a gap list.
- Leadership exempt. Executives are the most impersonated people in the business. Enrol them first.
FAQ
Does the Essential Eight require security awareness training? No — it is not one of the eight strategies. But the framework assumes the human layer holds, several strategies depend on user decisions (MFA approvals, privilege discipline), and assessment frameworks such as SMB1001 expect staff awareness evidence.
Which Essential Eight strategies does awareness training support? Primarily MFA (staff approving prompts safely), restricting administrative privileges (staff reporting access attempts) and user application hardening (staff not installing risky software). It also covers the payment-fraud attacks that bypass technical controls entirely.
Is Essential Eight compliance mandatory for Australian businesses? It is mandatory for Australian Government entities at specific maturity levels. For private businesses it is largely driven by contracts, tenders, insurers and frameworks like SMB1001 that reference it.
What evidence should we keep for assessment? Dated per-learner training completion, phishing simulation click and report trends, and the programme policy — exportable monthly, filed alongside your other E8 evidence.
How often should staff train? Monthly. Five-to-ten minute lessons plus one phishing simulation per month; the published 87% susceptibility reduction is measured on sustained monthly cadence.
How much does it cost? $10-$72 per employee per year; a 50-person team commonly pays $900-$1,800 annually at a mainstream tier.
One last thing
The Essential Eight hardens the systems an attacker would love to skip. Awareness training hardens the person they would rather target instead. An E8 programme that pairs both is the only version an auditor, an insurer or a real attacker will treat as complete.