In short: Free security awareness training in the UK starts with the NCSC's Top Tips for Staff, a short e-learning course on phishing, passwords, devices and reporting that can run online or in your own LMS. The NCSC also offers board-level resources, and Microsoft gives E3 customers a trial subset of Attack Simulation Training. Free options lack automated simulations and reporting.
NCSC Top Tips for Staff
The National Cyber Security Centre's Top Tips for Staff is the best free starting point for UK organisations. It is a short e-learning course aimed particularly at small organisations, charities and the voluntary sector, and it covers four essentials:
- Defending yourself against phishing
- Using strong passwords
- Securing your devices
- Reporting incidents
It ends with a short quiz. You can use it in two ways:
- Online, through the hosted web version, with no set-up
- In your own learning management system (LMS), by downloading a SCORM package (the NCSC provides SCORM 2004 and SCORM 1.2 versions in English, and a Welsh version). Once it is in your LMS, completions sit alongside your other training records, and you can adjust settings such as the quiz pass rate. The content is published under the Open Government Licence
It takes under 30 minutes and is written for non-technical staff. Schools have a separate free NCSC package, cyber security training for school staff, and members of the DfE's Risk Protection Arrangement (RPA) must evidence that relevant users complete the free NCSC training each year; see security awareness training for schools. For more on what the NCSC recommends, see NCSC guidance on staff security awareness training.
Other free UK resources
- NCSC Small Business Guide and Small Charity Guide: plain-English steps on backups, protecting devices and accounts, and spotting scams; see security awareness training for charities
- NCSC Cyber Action Toolkit: a free online tool that gives sole traders and small businesses a short list of basic actions to take against cyber criminals
- NCSC Cyber Security Toolkit for Boards and Cyber Governance Training: free resources for directors and trustees, organised around the Cyber Governance Code of Practice, with an introduction and five online modules of about 20 minutes each; see cyber security training for board members
- NCSC Exercise in a Box: free tabletop exercises to rehearse how your organisation would respond to an incident
- National reporting routes: forward suspicious emails to the NCSC's Suspicious Email Reporting Service at report@phishing.gov.uk, and scam texts to 7726; see how to report a phishing email
- Your own material: a short quiz, a newsletter or a lunch-and-learn costs nothing; see our cyber security quiz for employees and security awareness ideas
Microsoft's E3 trial of Attack Simulation Training
Microsoft's Attack Simulation Training is fully available only with Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2. Microsoft 365 E3 customers get a limited trial subset at no extra charge: the Credential Harvest payload, plus the choice of the ISA Phishing or Mass Market Phishing training experiences. Nothing else is included in the E3 trial.
That is enough to run a basic credential-harvest test and assign a short course, which can be a useful baseline. Microsoft also offers a free 90-day trial of Defender for Office 365 Plan 2, including Attack Simulation Training, through the trials hub in the Microsoft Defender portal. See Attack Simulation Training licensing and how to set up Attack Simulation Training.
Where free stops
Free resources teach the basics well. What they do not do is run a programme:
| Need | Free resources | A paid platform |
|---|---|---|
| Core knowledge | Yes, for example NCSC Top Tips for Staff | Yes, plus a wider, regularly updated library |
| Realistic phishing simulations | No (only the limited Microsoft E3 trial) | Yes, varied and scheduled, with instant teaching on a click |
| Automatic enrolment of new starters | Only if you build it into your own LMS | Yes, through Microsoft Entra ID or Google Workspace sync |
| Reminders and chasing | Manual | Automatic |
| Report button and report-rate tracking | No | Usually included |
| Role-based and sector content | Limited | Yes |
| Records for insurers and auditors | Only what your LMS records | Dashboards and exportable reports |
| Policy acknowledgement | No | Available on some platforms |
The gap that matters most is measurement. Without simulations and reporting, you know who completed a course but not whether behaviour changed. See measuring security awareness training effectiveness.
Making the most of free, then moving on
A sensible path for a small organisation:
- Ask everyone to complete NCSC Top Tips for Staff and keep a simple completion register
- Agree a reporting route and tell staff to use it, with no blame for mistakes
- Add the technical basics in Cyber Essentials, especially MFA
- When you need simulations, automation or evidence for an insurer, move to a platform; see choosing security awareness training software
Paid platforms are licensed per user, so they scale down to small teams. See security awareness training cost for what drives the price, or security awareness training for small business.
Contact us if you want help moving from free resources to a full programme.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is the NCSC Top Tips for Staff training free?
Yes. It is free to use online and free to download as a SCORM package for your own learning management system. The content is published under the Open Government Licence.
Can I put the NCSC training into our own LMS?
Yes. The NCSC provides SCORM 2004 and SCORM 1.2 packages in English and a Welsh version. Once imported, completions are kept with your other LMS training records, which helps with evidence, and you can set your own quiz pass rate.
Is there a free phishing simulation tool?
Microsoft 365 E3 customers get a limited trial of Attack Simulation Training with the Credential Harvest payload. Full simulation capability needs Microsoft 365 E5, Defender for Office 365 Plan 2 or another paid platform.
Is free training enough for cyber insurance?
It depends on the insurer's questions. Many proposal forms ask about phishing tests as well as training, which free resources do not provide. See security awareness training for cyber insurance.