Security Awareness for SMEs Without an IT Department

By Fabian Hable · March 17, 2026 · 6 min read

You’re the managing director of a company with 10, 30, or 50 employees. You don’t have your own IT department, no CISO, and no budget for an enterprise security platform. Yet according to NIS2, you’re supposed to train your employees. How?

The good news: It’s easier than you think. And it doesn’t have to cost anything.

The Pragmatic Path: 4 Steps

Step 1: Roll Out Free Training (Day 1)

Send your employees the link to the Webguardiola Community Training. Sign up via email code, zero IT effort. Training takes about 45 minutes.

Step 2: Track Participation (Weeks 1–2)

Every completed training ends with a quiz and a personal certificate. Ask your employees to file their certificate — that becomes your proof of participation.

Step 3: Collect Evidence (Weeks 3–4)

Collect the certificates centrally. For documented training records and company reports, there is the Business package — for companies with their own LMS, the SCORM package.

Step 4: Decide (Day 30+)

You decide whether the current state is sufficient or whether you want an ongoing program. No obligation.

The most expensive security training is no security training. A single ransomware attack costs an SME an average of €200,000–500,000.