Free cyber security training for your whole team. Meet Lessons from IT.

Most of the cyber incidents I get called out to don’t start with clever code. They start with one person, on a busy afternoon, clicking one thing that looked completely normal. A fake invoice. A “quick favour” email from the boss. A Microsoft login page that wasn’t Microsoft.

So I’ve built something to help with that. Lessons from IT is a free cyber security awareness course for everyone in your business, not just the IT people. It’s live today at fromit.co.uk/training, and there’s no sign-up, no trial and no catch.

Why staff training matters more than ever

The government’s own numbers make the case better than I can. The Cyber Security Breaches Survey 2025/2026, published in April, found that:

• 43% of UK businesses had a cyber security breach or attack in the last 12 months. That’s roughly 612,000 businesses.
• Phishing was the most common attack by far, hitting 38% of businesses, and it was named the most disruptive type of attack by 69% of those who had one.
• Yet only 19% of businesses gave their staff any cyber security training or awareness sessions in the same year. Among large businesses it was 84%.

Put those together and you get the problem in one line: the most common attack goes through people, and most businesses never show their people what it looks like. Big firms train because they have security teams and budgets. Everyone else is left hoping nobody clicks.

Firewalls, antivirus and multi-factor authentication do a lot of heavy lifting, and I’ll always push for them. But they can’t stop someone from approving a payment to a criminal’s bank account, or reading a one-time code out to a “Microsoft engineer” on the phone. Only a person who knows the signs can do that.

What is Lessons from IT?

It’s a short, plain-English course that lives at learn.fromit.co.uk. Each lesson arrives as a memo from IT in a mock office inbox, so it feels more like reading your email than sitting through a slideshow. Every memo ends with a few quick questions, and when you’ve finished all eight you get a certificate with your name and the date on it.

• Free for everyone, every year.
• About 45 minutes in total, split into eight short memos you can do in one go or over a week.
• Works on phones, tablets and laptops, so people can do it on the train or between jobs.
• No sign-up and no personal data. Progress is saved in each person’s own browser and the certificate is made on their device.

The eight memos

The course follows the five Cyber Essentials controls, the UK government backed baseline against the most common attacks, and turns them into the everyday habits that keep those controls working.

• Memo 01: Why would anyone hack us? Why every business is a target, and what criminals are actually after.
• Memo 02: That email isn’t from your boss. Phishing, invoice fraud and the fake “quick favour”.
• Memo 03: Your password is probably Summer2026! Passphrases, password managers and multi-factor authentication.
• Memo 04: Yes, you do have to restart. Updates within 14 days, screen locks and unsupported devices.
• Memo 05: Where did you download that? Malware, approved software, macros and USB sticks found in the car park.
• Memo 06: The café Wi-Fi isn’t your friend. Public Wi-Fi, firewalls, working from home and lost devices.
• Memo 07: Who has the keys? Admin accounts, least access, starters and leavers.
• Memo 08: Something’s wrong. Now what? Spotting a cyber incident and reporting it fast, without blame.

Every example comes from the kind of incident I actually deal with. The invoice that changed bank details halfway through a thread. The mailbox rule that quietly forwarded everything to a stranger. The “can you just grab me some gift cards?” text. If your team recognises those, they’re a lot harder to fool.

Most incidents start with one person clicking one thing. A short, decent course is the cheapest fix there is.

Ashley Adkins, fromIT

Why I made it free

Good awareness training usually comes with a per-user licence, an annual contract and an admin portal that somebody has to learn. For a lot of businesses that’s exactly why it never happens, and it’s why that 19% figure is so low.

I’d rather remove every excuse. If a ten-person firm can roll this out with one message on a Monday morning, the whole country gets a little harder to scam, and the calls I get on a Friday afternoon get a little less painful. That’s worth more to me than a licence fee.

It’s also an honest way to show how I work. If you like the course, you’ll probably like working with me on the rest.

How to roll it out in five minutes

1. Send your team the link. The training page has a ready-made message you can copy into an email, Teams or WhatsApp.
2. Collect the certificates. Ask everyone to send you their PDF when they finish, and keep them in one folder. That folder is your training record.
3. Repeat it every year. Add it to your new starter checklist too, so it happens in everyone’s first week.

Give people a deadline, about a week works well, and do it yourself first. Nothing gets a team to finish a course like the boss saying “I scored 5 out of 5 on the phishing one”.

Does it help with Cyber Essentials, ISO 27001 and insurance?

Yes. Cyber Essentials is mostly about your devices, accounts and settings, but the question set also asks how you help staff with things like creating strong, unique passwords. The course covers that, and the certificates show it happened. If you’re wondering how ready you are overall, my free Cyber Essentials readiness check takes about seven minutes.

For ISO 27001, awareness training is a requirement (Annex A 6.3), and a folder of dated certificates is good evidence for your auditor.

Cyber insurers and supplier security questionnaires increasingly ask whether staff get regular awareness training too. “Yes, everyone completes it every year, here are the certificates” is a simple, honest answer. My guide to answering supplier security questionnaires covers the rest of those questions.

What training can’t do

I’ll be straight with you: training isn’t a force field. People are busy, and good scams are very good. The goal isn’t a team that never clicks anything. It’s a team that spots most of it, and speaks up fast when something feels wrong, without worrying they’ll get in trouble. That’s why Memo 08 is all about reporting, and why it matters that the boss says “thanks for telling me” rather than “how could you?”.

Training covers the people. Cyber Essentials covers the rest: updates, admin rights, malware protection, firewalls and secure settings. Together they stop the large majority of the attacks I see. And if something has already gone wrong, that’s a cyber incident, and I can help today.

FAQ

Is Lessons from IT really free?

Yes. There’s no sign-up, no trial, no per-user fee and no catch. Your whole team can take it, every year.

How long does the course take?

About 45 minutes in total across eight short memos. People can do it in one sitting or a memo at a time.

Do you collect any personal details?

No. There’s no account. Progress is saved in each person’s own browser and the certificate is created on their device. I only see anonymous page statistics.

Can I see who has finished?

Not yet. For now, ask everyone to send you their certificate PDF and keep them in a folder. Team tracking for managers is planned.

Is it suitable for non-technical staff?

That’s exactly who it’s for. It’s written in plain English with real examples, and no IT knowledge is needed.

How often should staff do cyber security awareness training?

Once a year for everyone, and in every new starter’s first week. A short refresher after a near miss is a good idea too.

Can you run the training live instead?

I can. A one hour remote staff security session for your whole team is £395, or it comes as an add-on to any Cyber Essentials package.

Ready to try it? Start the free Lessons from IT course. It takes about 45 minutes and your team can start today.

Sources

• Cyber Security Breaches Survey 2025/2026, Department for Science, Innovation and Technology, 30 April 2026.
• 10 Steps to Cyber Security: engagement and training, National Cyber Security Centre.