Security Awareness for SMEs Without an IT Department

By Fabian Hable · March 17, 2026 · 6 min read

You’re the managing director of a company with 10, 30, or 50 employees. You don’t have your own IT department, no CISO, and no budget for an enterprise security platform. Yet according to NIS2, you’re supposed to train your employees. How?

The good news: It’s easier than you think. And it doesn’t have to cost anything.

The Pragmatic Path: 4 Steps

Step 1: Roll Out Free Training (Day 1)

Send your employees the link to the free Webguardiola training. Sign up via email code, zero IT effort. Security Awareness Part 1 takes about 45 minutes; NIS2 Essentials and the management training are free as well.

Step 2: Track Participation (Weeks 1–2)

Every completed training ends with a quiz and a personal certificate. Ask your employees to file their certificate — that becomes your proof of participation.

Step 3: Collect Evidence (Weeks 3–4)

Collect the certificates centrally. If collecting becomes too much work: the company dashboard shows who has finished from €490 per year and provides the audit report. For companies with their own LMS, there is the SCORM package.

Step 4: Decide (Day 30+)

You decide whether the collected certificates are enough or whether you add the dashboard. No obligation, and earlier completions count.

The most expensive security training is no security training. A single ransomware attack costs an SME an average of €200,000–500,000.