Security Awareness for SMEs: The Human as the Smartest Link

Firewall, CrowdSec, Mail-Gateway, Patch-Management — everything done correctly. And then "Microsoft Support" calls and someone reveals their password. Security awareness is not a training module completed once, but an attitude that lives in daily practice.

Why this must work in SMEs

In large corporations, there is an awareness team running phishing campaigns and purchasing e-learning modules. In an SME with 30 employees, this is done on the side — usually by the person who also manages IT.

The good news: Small teams are socially closer. A personal conversation has more impact than an anonymous mandatory module.

What works

• No annual lectures, but monthly bite-sized sessions: Five minutes during the team meeting, a current example, a clear action. "This week there was a phishing email with sender customs office — this is what it looked like, that was suspicious."
• Positive feedback, not punishment: Someone who reports a suspicious email gets a thank you, not a test. Someone who clicks gets no reprimand, but an explanation.
• Password manager as a basic right: Every employee receives a password manager. No sticky notes, no Excel list, no "password123". KeePassXC or Vaultwarden — the initial hurdle is the only effort.

Phishing: The Premier Discipline

The best spam filter (NoSpamProxy) catches 99%. The 1% that gets through — a personalized email, a current pretext — reaches the human. Exactly for this, awareness exists.

Rule: Never click, always verify. Check the sender address, not the sender name. Do not open attachments that were not announced. In doubt: call, do not reply.

Who wants to practice the emergency case can run their own phishing simulations — for example with the open-source Gophish, in-house operation and with clear, positive evaluation instead of public shaming.

AI makes the attack better

The era of clumsy phishing emails with spelling errors is over. Generative AI formulates flawless, personalized emails — and cloned voices make the classic CEO call dangerously convincing. Thus, the process rule becomes even more important: Confirmation via a second, known channel, not via the one the request came from.

NIS2 and Awareness

NIS2 requires "appropriate training measures". This is not a certificate to hang on the wall, but a process that must be demonstrable: Who was trained when on which topic? A simple log — even in markdown git — suffices.

Awareness for Management

Management is the favorite target — full access, little time, high authority. A CEO fraud ("Please transfer urgently...") still works. The solution: short paths, personal confirmation, no payment without telephone callback.

Conclusion

Security awareness in SMEs needs no budget, but someone who persists. Short impulses, clear rules, positive culture. The human is not the weakest link — he is the last line of defense when technology fails. And he must be prepared for that.