← All Blogs

Who gets trained first when you can only afford ten seats

By Best IT MSP Editorial Team - Updated October 22, 2026 - 11 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

Who do you train first when you can only afford ten seats?

Train the people who can move money, grant access, or be impersonated. That is three kinds of authority rather than ten names, and CISA has already published the list of roles that need more than general awareness.

CISA's Cross-Sector Cybersecurity Performance Goals set a baseline for everybody, covering recognizing social engineering attempts and other common attacks and reporting attacks and suspicious activity. Goal 3.J then goes further. It asks you to identify the specialized roles within the organization that require additional cybersecurity training, and it names them: physical and cybersecurity personnel, system administrators, finance personnel, senior leadership, and anyone with access to business-critical data.

In a business of 35 people that list is four or five jobs. Whoever pays suppliers. Whoever runs payroll. Whoever holds the administrator account. The owner. Add anybody who handles customer records, and your shortlist is written before you have read a single vendor brochure.

One note before the order. This is about exposure, not competence. Nobody on the list is less careful than the colleague who missed it. They are on it because an ordinary day in their job contains the exact action an attacker wants performed, and because a mistake there is expensive rather than embarrassing.

Rank the authority, not the person.

The awkward part is what that list implies about the product. Security awareness training is sold per seat and pitched at everyone, so the sales conversation is always about headcount. Your exposure is not spread by headcount, and the next section puts a number on the gap.

Why train everyone is not advice

Train everyone is a budget, not a priority. It sounds responsible and tells you nothing about where to start, which is the only question a limited budget actually asks.

The generic annual module is also the weakest item in the catalogue. Researchers sent ten simulated campaigns to 19,500 employees at UC San Diego Health over eight months. They found no significant relationship between whether users had recently completed an annual, mandated course and the likelihood of falling for phishing emails. Training delivered at the moment of the click did better, and only just, because it reduced the likelihood of clicking on a phishing link by 2%.

Read that as a budget constraint rather than a reason to cancel anything. Two percent spread across 35 people is not a control you can point at in a review. The same money spent on one verification procedure, taught properly to the two people who release payments, changes what happens on the day a supplier asks for a bank detail change.

We are not relitigating whether awareness training works. Report rate, not click rate, is the phishing simulation number that matters covers that research and the number to measure instead. What follows is the allocation question it leaves open. Ten seats, 35 people, and no honest way to pretend the risk is evenly spread.

Does published guidance back training some people differently?

Yes. Two US regimes separate general awareness from role-specific training in their own text, which makes prioritizing a documented practice rather than a compromise you had to make.

CISA states it outright. Goal 3.J asks you to provide role-based cybersecurity training to all those in specialized roles, including contractors, partners, suppliers, and other third parties. Count the four groups in that list who are not on your payroll. We come back to them, because one of your highest-exposure roles is probably not your employee.

The FTC's Safeguards Rule splits the same way inside one paragraph. It requires providing your personnel with security awareness training that is updated as necessary for the workforce, then separately requires providing information security personnel with security updates and training, and then verifying that key information security personnel take steps to maintain current knowledge. General awareness for everybody, something harder for the specialists, and a verification step attached only to the second group.

That rule binds financial institutions as the FTC defines them, which reaches a long way past banks and catches firms that never think of themselves that way. Treat it as a model if it does not bind you. The structure is the useful part: two populations, two obligations, written by a regulator with nothing to sell you.

What nobody publishes is an effectiveness figure for role-based security awareness training. There is no federal percentage and no primary study measuring the role-based version against the general one, so a vendor quoting you a number is quoting itself. The case for ordering rests on the loss data and on the authority attached to each job.

Which roles are documented as targeted, not assumed?

Three roles appear in government advisories and federal loss data rather than in marketing: whoever can change where money goes, whoever can reset a credential, and whoever is senior enough to be worth imitating.

Finance is the best documented of the three. In 2025 the FBI logged 24,768 business email compromise complaints carrying $3,046,598,558 in reported losses, against 191,561 phishing and spoofing complaints carrying $215,843,126. Divide each pair. A phishing complaint averages about $1,127. A business email compromise complaint averages about $123,005, roughly 109 times more. Four numbers from one table, and the clearest ordering signal published anywhere.

Anyone who can reset a credential comes second. The joint advisory on Scattered Spider, co-signed by the FBI, CISA and five partner agencies, records a group that targets large companies and their contracted information technology (IT) help desks and works to convince IT and/or helpdesk staff to provide sensitive information, reset the employee's password. The same advisory records actors gathering the personally identifiable information (PII) of users with elevated access to their network, which is reconnaissance aimed at a named job rather than a mail-out.

Carry the scope with it. That advisory describes attacks on large companies, and a 35-person firm is not the target profile. The mechanism travels anyway, because the reset desk for a small business is usually a contract, and the same actors posed as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees, which works at any size.

Senior leadership is third, and here the exposure runs backwards. The owner is not on the list for clicking more often. The owner is on the list because their name is the lever used on everybody else. The FBI has recorded actors exploiting AI-generated audio to impersonate well-known, public figures, and the same pattern reaches a 35-person company the moment a finance clerk takes a call in the owner's voice.

No primary study publishes a targeting rate by job title. We looked for one, and the material claiming it is vendor content with no sample behind it. So order the list on what the loss data and the advisories support, and say so plainly when a chart arrives with no method attached.

What your finance lead needs taught is not phishing spotting

Your finance lead needs a verification procedure, not a spotting skill. In the expensive version of this fraud the email is genuine, sent from a supplier's own compromised mailbox, so there is nothing in the message to spot.

The procedure has four parts and takes twenty minutes to teach. A phone number you held before the request arrived. An outbound call, never an inbound one. A written note of who called and which number they used. And standing authority to hold the payment while they do it.

CISA's social engineering guidance supplies the first part. It tells people to try to verify it by contacting the company directly and, more usefully, to check previous statements for contact information rather than use the number that arrived with the request. The FBI supplies the second, advising recipients to independently identify a phone number for the person and call to verify their authenticity. Independently is the operative word, because a number inside the request came with the fraud.

This is also why a module is the wrong vehicle for it. 75% of users engaged with the embedded training materials for a minute or less in the UC San Diego study, and a payment procedure does not survive a minute of skim reading. It gets taught at a desk, with a real supplier record open, by somebody who watches them make the call once. This is a non-technical control and it stays that way.

The control behind the call is a separation of duties, and we do not rebuild it here. Dual approval only stops invoice fraud if you split the right two jobs covers the split, and Business email compromise is not phishing, and it targets your finance team covers the attack itself. The training half is the permission. Somebody taught to verify, who has also learned that delaying the owner's urgent payment earns a telling-off, has not been trained. They have been handed a conflict, and this fraud is built on exactly that conflict.

What an administrator needs that an ordinary user does not

An administrator needs a procedure for proving who is on the phone. An ordinary user is taught to distrust a message. The one privileged account holder in the building gets asked, politely and plausibly, to do their actual job for the wrong person.

Credentials are the way in. Sophos found four in five (79%) of ransomware attacks starting with compromised identities. A password handed to a convincing caller is not a technical failure and leaves no trace a filter can read, because nothing was forged and no rule was broken.

Three things belong in that session and in nobody else's. How a caller's identity is proved before a password is reset or an authenticator is moved to a new device. What happens when the caller is angry, senior and in a hurry. Who may approve an exception, and where it gets recorded.

Published guidance is thin at this exact point, which is worth knowing before you buy anything. The Scattered Spider advisory's own mitigation for the help desk route asks organizations to continue to perform diligent employee training against vishing and spearphishing and sets out no verification steps for the reset itself. The procedure is yours to write.

Now the line most shortlists miss. In a 35-person business the reset desk belongs to your provider, so one of your ten seats cannot be bought at all. CISA extends role-based training to contractors, partners, suppliers, and other third parties, which means the obligation follows the role out of your building. What you can do is ask, in writing, how your provider's help desk proves who a caller is before it resets a password or moves an authenticator, and then keep the answer on file.

What that account should be able to do in the first place sits in Who is the Global Administrator on your Microsoft 365 tenant?. The factor that survives a convincing phone call sits in MFA fatigue attacks, and how to train for a prompt you did not expect.

Ten people, or ten moments?

Spend part of the ten on moments rather than on names, because a list of people goes stale inside a year and a trigger does not.

The published cadence is narrower than most policies. CISA asks that new employees receive initial cybersecurity training prior to accessing computer systems and that you provide at least annual cybersecurity training for all organizational users. Before access, then once a year. That is the whole of it.

Two published triggers, and one obvious gap. Nothing we could find in published guidance names a role change, which is the moment that matters most in a small business. Whoever took over supplier payments last month carries the exposure of the new job and the training of the old one. Read CISA's trigger literally and it attaches to the access rather than to the start date, which is our reading rather than CISA's words.

So hold three of the ten open. Use one the week you hire somebody, before they get access to anything. Use another the week a colleague first gains the ability to change a bank detail or approve a payment. A seat spent on the day authority changes hands is worth more than a seat spent on an annual reminder in March.

What the other 25 people get instead of a seat

Give the other 25 a control, not a certificate. The budget is spent, and the honest swap is a setting that reduces what a mistake can do.

Three of those cost nothing beyond the configuration time. Phishing-resistant multi-factor authentication, which CISA strongly urges all organizations to implement. A report button somebody actually reads, with no penalty for anyone who reports a mistake. And no local administrator rights on an ordinary laptop.

That trade is not a downgrade dressed up as strategy. A control applies at two in the morning to a tired person who has forgotten every module they ever sat through, while training applies only for as long as they remember it. Where you can afford one of the two for a given person, buy the control.

• Ask how your provider's help desk proves who a caller is before it resets a password or moves an authenticator.
• Name everyone who can change a supplier bank detail today, then check that list against who you assumed it was.
• Confirm which accounts hold phishing-resistant MFA, starting with accounts payable and the administrator account.

The reporting half of this has a post of its own, because the consequence you attach to a mistake decides whether you ever hear about it. Read Punish staff for clicking and the person who clicked stops telling you before you write the policy.

Nothing here makes a business safe and no provider can promise that. What it does is put the money where a single mistake is expensive, and leave a dated written record of the choice for whoever asks about it next year.

FAQ

Who should get security awareness training first in a small business?

Start with the roles CISA names in its own training goal: system administrators, finance personnel, senior leadership and anyone with access to business-critical data. In a 35-person firm that is four or five people. Order them by what one mistake costs, which the FBI's loss table settles.

Is role-based security awareness training required anywhere?

Yes. CISA's goal 3.J asks organizations to provide role-based cybersecurity training to all those in specialized roles. The FTC's Safeguards Rule separately requires providing information security personnel with security updates and training, on top of the awareness training it requires for all personnel.

Is generic annual training worth buying for everyone?

Only as a baseline. A UC San Diego study of 19,500 employees found no significant relationship between whether users had recently completed an annual, mandated course and falling for phishing, and embedded training reduced the likelihood of clicking on a phishing link by 2%. Buy it cheaply and spend the difference on procedures.

What should finance staff be trained on instead of spotting phishing?

A verification procedure. CISA advises people to check previous statements for contact information rather than use a number supplied with a request, and the FBI advises recipients to independently identify a phone number for the person and call to verify their authenticity. Teach the outbound call, the written record, and the permission to delay a payment.

Should we train our IT provider's help desk?

You cannot, and you do not have to. CISA extends role-based training to contractors, partners, suppliers, and other third parties, so ask your provider how its help desk proves who a caller is before resetting a password. The Scattered Spider advisory records attackers who convince IT and/or helpdesk staff to provide sensitive information, reset the employee's password.

← All Blogs