Cybersecurity awareness training: A clear and practical guide

Oct 23, 2026

Introduction

Cyberattacks are becoming more frequent and more sophisticated. Small and medium-sized organizations want to strengthen their cybersecurity posture, but many lack the necessary tools, time or guidance. The 2026 Small Business Cybersecurity Awareness & Practices Survey, conducted by the National Cybersecurity Alliance and the Cybersecurity and Infrastructure Security Agency (CISA), surveyed 1,000 business leaders. The resulting report provides a foundation for strengthening cybersecurity awareness and readiness.

Key takeaways from the survey

The survey data makes clear that organizations have many of the right tools but still aren’t fully protected. Hackers know this too, which is why they seek the gaps between adoption and execution. Consider some of these other consequential findings from the report:

  • More than half of organizations (56%) cannot confirm a clean security record over the past year
  • Although 87% of represented businesses have adopted AI tools, only 46% have formal AI guidelines or policies
  • 88% use multi-factor authentication (MFA), but half (49%) do not require it for all users
  • Likewise, 88% maintain backups, but only 61% have tested those backups

Why cybersecurity awareness training matters

Training helps employees recognize and respond to threats before they escalate. It strengthens the human layer of defense by helping staff understand how attacks occur, and how they play a part in the organization’s cybersecurity program. Many organizations want to improve but feel overwhelmed, a dynamic that underscores the importance of training as a skill-building—and confidence-inspiring—best practice.

Recommended actions for government leaders

Require cybersecurity tools and regularly test that they work. Do this by:

  • Adding MFA for all accounts
  • Not just “having” backups; test them too
  • Ensuring software gets patched and stays up to date

Document policies so future incidents don’t catch you unprepared. You should:

  • Write and maintain cybersecurity and AI policies
  • Create an incident response plan (IRP) to get ready for an incident before it occurs, and then practice the plan
  • Ensure employees understand and follow cybersecurity expectations through regular, role-specific training and education

Free resources and where to get help

The good news is that leaders want help. The survey showed many leaders want assistance, with more than 55% saying they would participate in free or low-cost cybersecurity training. Specifically, respondents expressed a desire for employee training, leadership guidance and incident response templates.

The State Auditor’s Office provides practical, no-cost support for governments looking to improve their cybersecurity readiness:

How to reach us for more assistance 

Do you have questions about cybersecurity? Reach out to us at Center@sao.wa.gov or call (564) 999-0818.