Yes — cyber security awareness training is worth it for almost any business with staff who open email, because the maths is one-sided: training costs roughly $10-$72 per employee per year, while the average cyber incident costs an Australian small business $56,000. But not all training is worth it — a one-off annual video with no measurement changes nothing. This guide gives the honest 2026 case for and against.
What the numbers say
The case rests on three numbers, all current for 2026:
- $10-$72 per employee, per year. That is the realistic price band for a commercial awareness training platform in Australia at small-business scale — a 50-person business typically pays $900-$1,800 a year all-in.
- $56,000 average loss per incident. Australian small businesses that reported a cybercrime to ASD in FY2024-25 lost an average of $56,000 per incident, across 84,700 reports — one every six minutes nationally.
- 33% down to 4-5%. Industry phishing benchmarks consistently show about a third of untrained users click a simulated phish; after 12 months of regular training and simulations that falls to 4-5%.
Even before any incident, trained staff report suspicious messages at meaningfully higher rates — and fast reporting is what limits the damage when a real attack lands. A $1,500 annual program that prevents one $56,000 incident pays for itself 37 times over; it only needs to improve your odds, not make you invulnerable.
What training actually changes
Good training changes three behaviours, in order:
- Fewer clicks. Regular short courses plus phishing simulations teach staff to pause on urgency, unexpected attachments and credential requests — the three patterns behind most real attacks.
- Faster reporting. Staff who know how to report a suspicious email do it in seconds instead of deleting it and saying nothing. Earlier reports cut containment time from days to minutes.
- Fewer risky workarounds. Trained staff share passwords less, question payment-change requests and escalate unusual requests from "executives" — which is where business email compromise actually gets stopped.
One-off annual training delivers the first behaviour for a few weeks and none of the rest. The research on spaced learning is unambiguous: short monthly sessions beat a single yearly course on retention, which is why the modern cadence is monthly.
When it is not worth it
Honesty requires the counter-case:
- A box-ticking program. If the goal is a compliance certificate and nobody measures click rates or report rates, the spend buys a policy document, not resilience. Training without measurement cannot prove it worked — human risk reporting exists precisely to close that gap.
- Shame-based training. Programs that punish staff who fail simulations suppress reporting, and suppressed reporting is the worst outcome. Coaching-first programs measurably outperform punitive ones.
- No email risk at all. A business where staff receive no external email and all payments run through a second-person approval process has little for awareness training to protect. That is rare, but it exists.
- Wrong buying stage. If you have not yet checked where your controls actually stand, a gap assessment tells you whether training is even your weakest control — sometimes MFA and backups come first.
What good looks like in 2026
The programs that move the numbers share four traits: monthly short sessions (5-15 minutes, not day-long workshops), phishing simulations on a regular cadence with immediate coaching, per-learner reporting that shows risk trending down over time, and content refreshed for current lures (AI-written phishing, invoice fraud, MFA fatigue). Platforms that deliver this run from $10 per employee per year at the value end to $72 at the enterprise end — see security awareness training for what a complete program includes, and the platform comparison if you are evaluating vendors.
FAQ
Is security awareness training worth it for a small business?
Yes — proportionally more than for enterprises, because a $56,000 average incident is existential at 20 staff while the training itself costs about $1,000-$1,500 a year at that size.
How long before training pays off?
Click rates on phishing simulations typically drop visibly within 2-3 monthly cycles. Report rates climb in parallel. Most businesses see the behavioural shift inside a quarter.
Can we just do the training ourselves?
Some businesses run a workable program with free government resources and internal reminders. What you lose is simulation tooling, per-learner tracking and audit-ready evidence — the parts that turn training into a measurable, reportable program.
Is training required for compliance or certification?
Increasingly yes: cyber insurance questionnaires ask for it, Essential Eight evidence expectations touch user education, and the SMB1001:2026 standard moved staff awareness training into its Bronze tier.
One last thing
The honest framing is not "does training stop all attacks" — it does not. It shrinks the target. A workforce clicking 4-5% instead of 33% is a smaller, slower, louder target, and attackers move on to easier ones.