Published: 26 May 2026 | By AOLC
After a cyber incident, business owners almost always ask the same question: "How did they get in?" The answer, more often than not, has nothing to do with a technical flaw in your firewall or a zero-day vulnerability in your software. Someone on the team clicked a link they should not have, opened an attachment that looked legitimate, or handed over credentials after a convincing phone call.
Cybercriminals know that the weakest point in any organisation is not the technology — it is the people. Technical security controls like firewalls, endpoint protection, and MFA are essential, but they cannot fully compensate for a team that does not know what to watch for. Security awareness training closes that gap. And compared to almost every other security investment you can make, it is remarkably affordable.
Research consistently shows that 85 to 95 percent of all cybersecurity incidents are caused or enabled by human error — not technical vulnerabilities. Training your people is not a nice-to-have. It is a fundamental security control.
Phishing emails, social engineering calls, and pretexting attacks all target the same thing: a human being who is busy, distracted, or simply unaware. Unlike malware, which can be blocked by a well-configured endpoint protection solution, a convincing phishing email lands directly in your employee's inbox and asks them to act. Without training, many people will — because the email looks like it came from their bank, their CEO, or a courier company, and because nobody ever showed them what the warning signs look like.
Maximum fine under POPIA for failing to protect personal information — including through failure to train staff adequately on data handling and cybersecurity.
South Africa is a particularly high-risk environment. Local businesses face all the same phishing and ransomware threats as their international counterparts, with the added challenge of load shedding — which disrupts backup processes, creates pressure to act quickly on IT issues, and generates a steady stream of fake "urgent" communications that attackers exploit. A well-trained team is your best defence against all of it.
Under POPIA (the Protection of Personal Information Act), organisations are legally required to take appropriate technical and organisational measures to protect personal information. Staff training is an organisational measure — and if a breach occurs and you cannot demonstrate that your team received adequate training, the Information Regulator of South Africa will take note. The regulator has moved from issuing warnings to actively imposing fines and referring matters for prosecution.
Security awareness training is not a once-off workshop or a box-ticking video. Effective training is an ongoing process — typically delivered in short, regular sessions throughout the year — that teaches employees practical skills they can apply immediately.
A good programme covers:
Reduction in phishing click rates that well-run security awareness programmes achieve within 12 months of consistent training and simulated phishing exercises.
Not all training programmes deliver the same results. Here is what separates genuinely effective training from a compliance exercise that nobody remembers by the following Monday:
Tip
Training platforms that integrate with Microsoft 365 let you launch simulated phishing directly from the same environment your team uses every day. This makes the tests realistic — and the reports easy to pull into your existing security management workflow.
This is where most business owners are pleasantly surprised. Compared to every other cybersecurity investment, security awareness training delivers an exceptional return for a very modest outlay.
For a business with 50 users, a fully managed programme — including monthly training modules, simulated phishing, and management reporting — typically costs between R500 and R2,000 per month. That is R10 to R40 per user per month.
| Investment | Monthly Cost (50 users) | What It Protects Against |
|---|---|---|
| Security awareness training | R500 – R2,000 | Phishing, social engineering, insider risk |
| Endpoint protection | R7,500 – R20,000 | Malware, ransomware, device-level threats |
| Cyber insurance | R8,000 – R20,000 | Financial recovery after an incident |
| Average SA ransomware incident | R500,000 – R5M+ (once) | n/a — this is what you're trying to avoid |
Security awareness training does not replace endpoint protection, managed security monitoring, or cyber insurance — but it dramatically reduces the probability that any of those investments will be tested in a real incident. It is the cheapest risk-reduction mechanism available to a South African business of any size.
Return on investment — for every rand spent on security awareness training, organisations save an estimated R37 in potential breach costs, according to the Ponemon Institute's security benchmark research.
Training works best when it is paired with the right technical controls and a clear written policy. A cybersecurity policy tells your team what they are required to do — training gives them the knowledge and skills to do it. Without a policy, training is informal and unenforceable. Without training, a policy is a document nobody reads.
If you have not yet written a cybersecurity policy for your business, start there. Our guide to writing a cybersecurity policy walks you through exactly what to include. Once the policy exists, training gives it teeth.
A cybersecurity policy without training is a document. Training without a policy is informal. You need both — and they need to be reviewed together at least once a year as threats evolve.
You do not need a large IT budget or a dedicated security team to run an effective security awareness programme. Here is a practical path forward:
Tip
Start by training the people with the most access to sensitive data or financial systems — finance teams, executives, and reception staff. These are the highest-value targets for attackers and deliver the greatest risk reduction per training hour.
Your people can be your biggest vulnerability — or your first line of defence. AOLC's Cyber Awareness Training programme gives your team the knowledge to recognise and stop attacks before they cause damage.
Book a Cyber Awareness Session